« Volver al listado

CVE-2025-42874

Estado: AplazadaAlta (7.9)—

SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls. Exploitation does not require user interaction and could lead to service disruption or unauthorized system control. This has high impact on integrity and availability, with no impact on confidentiality.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto con privilegios altos (PR:H) a servicio SAP sin interacción del usuario: T1210. Ejecución de código arbitrario, DoS potencial y corrupción de datos evidentes en el impacto de integridad y disponibilidad (I:H/A:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentRestrict File and Directory Permissions

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

SAP — NetweaverAISAP — XcelsiusAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-42874",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-42874",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-09T16:39:41.946056Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.9,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP NetWeaver (remote service for Xcelsius)",
          "versions": [
            {
              "status": "affected",
              "version": "BI-BASE-E 7.50"
            },
            {
              "status": "affected",
              "version": "BI-BASE-B 7.50"
            },
            {
              "status": "affected",
              "version": "BI-IBC 7.50"
            },
            {
              "status": "affected",
              "version": "BI-BASE-S 7.50"
            },
            {
              "status": "affected",
              "version": "BIWEBAPP 7.50"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-09T16:17:51.497",
  "references": [
    {
      "url": "https://me.sap.com/notes/3640185",
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-405"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls. Exploitation does not require user interaction and could lead to service disruption or unauthorized system control. This has high impact on integrity and availability, with no impact on confidentiality."
    },
    {
      "lang": "es",
      "value": "El servicio remoto de SAP NetWeaver para Xcelsius permite a un atacante con acceso a la red y privilegios elevados ejecutar código arbitrario en el sistema afectado debido a una validación de entrada insuficiente y un manejo inadecuado de las llamadas a métodos remotos. La explotación no requiere interacción del usuario y podría provocar la interrupción del servicio o el control no autorizado del sistema. Esto tiene un alto impacto en la integridad y la disponibilidad, sin impacto en la confidencialidad."
    }
  ],
  "lastModified": "2026-09-30T23:10:00.237",
  "sourceIdentifier": "cna@sap.com"
}