CVE-2025-0066

Under specific environmental conditions, the Internet Communication Framework (ICF) component in SAP NetWeaver AS for ABAP does not properly enforce access restrictions (CWE-732 – improper permissions configured for resources). An attacker with basic network access and minimal privileges can exploit this vulnerability to gain access to information and resources they should not have access to. The vulnerability does not require user interaction, and its scope extends beyond the original application context (Scope Changed).

An attacker can gain unauthorized access to protected data and functions of the SAP system, which may result in disclosure of sensitive business information, data modification, and disruption of application availability.

Apply patches available from the vendor according to references – SAP note no. 3550708 published as part of SAP Security Patch Day (https://url.sap/sapsecuritypatchday). Immediate implementation of the fix is recommended due to critical CVSS level 9.9.

SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) – SAP Basis; specific versions indicated in vendor references (SAP note 3550708)