CVE-2025-43005: SAP GUI for Windows Credential Exposure Flaw

CVE-2025-43005 Overview

CVE-2025-43005 affects SAP GUI for Windows and stems from insecure obfuscation algorithms used by the GuiXT application to store user credentials [CWE-256]. An attacker with local access to the system can reverse the weak obfuscation and recover plaintext credentials stored by GuiXT. The flaw affects confidentiality only and does not impact integrity or availability of the application. SAP addressed the issue through its monthly Security Patch Day release.

Critical Impact
Local attackers can recover SAP user credentials stored by GuiXT because the application uses a weak obfuscation algorithm instead of proper cryptographic protection.

Affected Products

SAP GUI for Windows (GuiXT component)
Refer to SAP Note #3574520 for the complete list of affected versions
See SAP Security Patch Day for release scope

Discovery Timeline

2025-05-13 - CVE-2025-43005 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43005

Vulnerability Analysis

The GuiXT scripting extension in SAP GUI for Windows stores user credentials using a reversible obfuscation routine rather than an authenticated encryption scheme. Because the transformation is deterministic and does not rely on a protected key, any party with read access to the stored data can recover the original password. The weakness falls under [CWE-256] Plaintext Storage of a Password, which treats obfuscation without cryptographic strength as equivalent to plaintext storage. Credential recovery requires local access to the files or registry locations where GuiXT persists the obfuscated secret.

Root Cause

The root cause is the use of a non-cryptographic obfuscation algorithm to protect credentials at rest. The algorithm lacks a secret key tied to the user or machine, so the inverse transformation can be derived from the implementation itself. This design pattern provides only trivial protection against casual inspection and fails against any attacker capable of reading the storage location.

Attack Vector

Exploitation requires local access to a Windows system running SAP GUI with the GuiXT application configured and credentials saved. An attacker who obtains the obfuscated credential blob — through filesystem access, backup acquisition, or endpoint compromise — can apply the known deobfuscation routine offline to recover the plaintext password. No authentication to SAP GUI itself is required to perform the recovery, and no user interaction is needed. The recovered credentials can then be used to authenticate to the SAP backend as the targeted user.

No verified public exploit code is available. See SAP Note #3574520 for vendor technical details.

Detection Methods for CVE-2025-43005

Indicators of Compromise

Unexpected read access to GuiXT configuration files or script directories by non-SAP processes
Access to GuiXT-related registry keys from unusual user contexts or scheduled tasks
Copy or exfiltration of GuiXT script files (.txt, .ini) to removable media or network shares
SAP logon activity from unexpected hosts shortly after local file access to a GuiXT-enabled workstation

Detection Strategies

Monitor file and registry access to GuiXT storage locations on endpoints running SAP GUI
Correlate workstation file reads of GuiXT artifacts with subsequent SAP authentication events from different IP addresses
Hunt for scripts or binaries that invoke the GuiXT deobfuscation routine or ship known SAP GUI DLLs outside of installation paths

Monitoring Recommendations

Enable endpoint telemetry for process and file access events on hosts running SAP GUI for Windows
Forward SAP Security Audit Log (SAL) events to a central platform and alert on logons that deviate from established user-to-host baselines
Track service account and privileged SAP user logons for geographic or time-of-day anomalies

How to Mitigate CVE-2025-43005

Immediate Actions Required

Apply the SAP GUI for Windows patch referenced in SAP Note #3574520
Instruct users to avoid storing passwords in GuiXT scripts and remove any credentials currently saved
Rotate SAP passwords for any accounts whose credentials may have been stored by GuiXT on potentially exposed workstations
Restrict filesystem and registry permissions on GuiXT configuration locations to the owning user only

Patch Information

SAP released a fix as part of its monthly Security Patch Day. Full remediation details, affected versions, and download instructions are published in SAP Note #3574520. Additional context on the release cycle is available on the SAP Security Patch Day portal.

Workarounds

Disable the credential storage feature in GuiXT where it is not required for business operations
Enforce single sign-on (SSO) or Secure Network Communications (SNC) so that static passwords are not needed in SAP GUI
Apply application allowlisting to prevent unauthorized processes from reading GuiXT configuration data

bash

# Configuration example
# Remove stored GuiXT credentials and tighten ACLs on the GuiXT script directory
# Replace <GuiXTPath> with the installed GuiXT script location
icacls "<GuiXTPath>" /inheritance:r
icacls "<GuiXTPath>" /grant:r "%USERNAME%:(OI)(CI)M"
icacls "<GuiXTPath>" /remove "Everyone" "Users"