CVE-2025-43004: Production Operator Dashboard Auth Bypass

CVE-2025-43004 Overview

CVE-2025-43004 is a security misconfiguration vulnerability affecting SAP Production Operator Dashboards (PODs). Customers can develop dashboards that expose non-sensitive customer data to unauthenticated external users. The root cause is a missing authorization check [CWE-862], which allows attackers to reach dashboard endpoints without providing credentials.

The vulnerability affects confidentiality only. Data integrity and availability remain unaffected because attackers cannot modify records or disrupt service. SAP addressed the issue in the May 2025 Security Patch Day release under SAP Note #3571096.

Critical Impact
Unauthenticated network attackers can read non-sensitive customer information exposed through misconfigured Production Operator Dashboards.

Affected Products

SAP Production Operator Dashboards (PODs)
SAP Manufacturing Execution deployments that expose PODs to untrusted networks
Custom dashboards built on the SAP PODs framework without authentication enforcement

Discovery Timeline

2025-05-13 - CVE-2025-43004 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43004

Vulnerability Analysis

The vulnerability exists because the SAP PODs framework does not enforce authentication on dashboards developed by customers. Developers can build operator dashboards intended for internal shop-floor use. When these dashboards are reachable from outside the plant network, the framework accepts requests without verifying identity.

An attacker sends standard HTTP requests to the dashboard endpoint. The application returns rendered content, including embedded production data, without prompting for credentials. The exposed information is classified as non-sensitive by SAP, but it may still include operational metadata useful for reconnaissance.

The EPSS score of 0.312% places CVE-2025-43004 in the 23rd percentile for exploitation probability. No public exploit code exists and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The defect maps to CWE-862: Missing Authorization. The PODs runtime does not require developers to attach an authentication policy to each dashboard. Dashboards deployed with default settings inherit no access control, so any client that resolves the URL can retrieve rendered pages and underlying data feeds.

Attack Vector

Exploitation requires network reachability to the dashboard host. The attacker does not need user interaction, credentials, or privileges. A GET request against the dashboard route returns the customer data included in the view. Automated scanners that enumerate SAP endpoints can locate exposed dashboards at scale.

SAP has not published proof-of-concept code. Refer to the SAP Note #3571096 and the SAP Security Patch Day advisory for the authoritative technical description.

Detection Methods for CVE-2025-43004

Indicators of Compromise

Unauthenticated HTTP GET requests to PODs dashboard routes originating from external IP ranges
User-agent strings associated with reconnaissance tools accessing /pod/ or dashboard-specific URIs
Repeated access patterns to the same dashboard endpoint from addresses outside the plant network segment

Detection Strategies

Review SAP web dispatcher and reverse proxy logs for dashboard requests missing session cookies or authorization headers
Correlate PODs access events with authenticated SAP user sessions to isolate anonymous traffic
Run authenticated vulnerability scans against the SAP Manufacturing Execution stack to enumerate dashboards missing security policies

Monitoring Recommendations

Alert on any external network flow reaching PODs application ports
Track the ratio of authenticated to anonymous requests per dashboard and flag deviations
Ingest SAP application logs into a central platform and build a rule for unauthenticated dashboard hits

How to Mitigate CVE-2025-43004

Immediate Actions Required

Apply the fix documented in SAP Note #3571096 on all SAP Manufacturing Execution and PODs instances
Inventory every customer-developed dashboard and confirm each one enforces authentication
Restrict PODs endpoints to trusted plant network segments through firewall or reverse proxy rules

Patch Information

SAP released the patch on the May 2025 Security Patch Day. Administrators must download SAP Note #3571096 from the SAP for Me portal and apply it according to the note's implementation instructions. Verify the fix by attempting anonymous access to a test dashboard after deployment.

Workarounds

Place PODs behind an authenticating reverse proxy that requires SAP single sign-on before forwarding requests
Configure network access control lists so only shop-floor subnets can reach dashboard hosts
Audit each custom dashboard and add authentication policies before exposing it to any wider network

bash

# Example reverse proxy rule blocking anonymous access to PODs
location /pod/ {
    auth_request /_sap_sso_check;
    error_page 401 = @deny;
    proxy_pass http://sap-me-backend;
}

location @deny {
    return 403;
}