CVE-2025-42959: HMAC Credential Replay Auth Bypass Flaw

CVE-2025-42959 Overview

CVE-2025-42959 is a high-severity authentication vulnerability affecting SAP systems that allows unauthenticated attackers to perform credential replay attacks. The vulnerability enables exploitation of Hashed Message Authentication Code (HMAC) credentials extracted from unpatched systems, which can then be reused against other systems in the environment—even those that are fully patched.

This vulnerability is classified under CWE-308 (Use of Single-factor Authentication), indicating a fundamental weakness in the authentication mechanism that fails to adequately verify the legitimacy of credential usage across different system contexts.

Critical Impact

Successful exploitation could result in complete system compromise, affecting confidentiality, integrity, and availability of targeted SAP systems, even when those systems have current security patches applied.

Affected Products

• SAP Systems (specific versions detailed in SAP Note #3600846)
• SAP environments utilizing HMAC-based authentication mechanisms
• Systems with cross-authentication trust relationships

Discovery Timeline

• 2025-07-08 - CVE-2025-42959 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-42959

Vulnerability Analysis

This vulnerability exploits a weakness in how SAP systems handle HMAC credential validation across different system instances. The core issue stems from single-factor authentication reliance (CWE-308), where HMAC credentials lack sufficient contextual binding to prevent their reuse across different systems.

The attack requires network access and involves extracting valid HMAC credentials from a system that lacks specific security patches. Once obtained, these credentials can be replayed against a separate system in the environment. The concerning aspect of this vulnerability is that the target system's patch status is irrelevant—even fully updated systems remain vulnerable to the replay attack if valid credentials are obtained from an unpatched source.

The exploitation complexity is considered high due to the requirement of first compromising or accessing an unpatched system to extract the HMAC credentials before the actual replay attack can be executed.

Root Cause

The root cause lies in the single-factor authentication model (CWE-308) implemented in the affected SAP authentication mechanism. The HMAC credentials are not sufficiently bound to:

• The originating system context
• Session-specific or time-bound parameters
• Source system identity verification

This allows credentials generated on one system to be accepted by another system without additional validation checks that would detect the cross-system reuse.

Attack Vector

The attack follows a multi-stage approach requiring network access to both an unpatched source system and the target system:

1. Credential Extraction: The attacker identifies and accesses an SAP system in the environment that is missing specific security patches
2. HMAC Capture: Valid HMAC credentials are extracted from the vulnerable system through network interception or direct access
3. Replay Execution: The captured HMAC credentials are replayed against a different target system in the network
4. System Compromise: Upon successful authentication, the attacker gains unauthorized access with the privileges associated with the replayed credentials

The vulnerability requires no prior authentication and can be exploited remotely over the network, though the attack complexity is elevated due to the multi-step nature of the exploitation process.

Detection Methods for CVE-2025-42959

Indicators of Compromise

• Authentication events with HMAC credentials that do not match expected client system identifiers
• Unusual authentication attempts from IP addresses that differ from the system where the credential was originally issued
• Multiple authentication requests using identical HMAC tokens across different system endpoints
• Authentication success events without corresponding preceding handshake or session initialization

Detection Strategies

• Implement cross-referencing of HMAC credential usage with originating system metadata to detect replay attempts
• Deploy anomaly detection for authentication patterns that indicate credential reuse across disparate systems
• Monitor for authentication events where the presenting client's fingerprint does not match the credential's expected source
• Establish baseline authentication behavior per system and alert on deviations indicating cross-system credential usage

Monitoring Recommendations

• Enable detailed SAP security audit logging to capture all authentication events with full contextual data
• Implement real-time correlation of authentication logs across all SAP systems in the environment
• Configure alerts for authentication events that fail secondary validation checks or contextual binding verification
• Monitor network traffic for HMAC tokens being transmitted between unexpected system pairs

How to Mitigate CVE-2025-42959

Immediate Actions Required

• Apply the security patches referenced in SAP Note #3600846 to all SAP systems in the environment
• Prioritize patching systems that may serve as credential source targets for attackers
• Audit all SAP systems to identify any that are missing the required security patches
• Implement network segmentation to limit cross-system authentication exposure

Patch Information

SAP has released security patches to address this vulnerability. Organizations should consult SAP Note #3600846 for specific patch details and installation instructions. Additionally, the SAP Security Patch Day portal provides comprehensive information about security updates and remediation guidance.

It is critical to patch ALL systems in the environment, as the vulnerability chain requires only one unpatched system to enable attacks against other systems.

Workarounds

• Implement additional authentication factors beyond HMAC credentials where supported
• Deploy network-level controls to restrict and monitor authentication traffic between SAP systems
• Consider implementing session binding mechanisms that tie HMAC credentials to specific system contexts
• Reduce the attack surface by limiting network exposure of systems that cannot be immediately patched
• Enable enhanced logging and monitoring to detect potential exploitation attempts while patching is in progress