CVE-2025-42909 Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances
High-privilege attackers can access other appliances due to insecure default profile settings in SAP Cloud Appliance Library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-42909?
CVE-2025-42909 is a low-severity vulnerability in SAP_SE SAP Cloud Appliance Library Appliances, published on 14 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL appliances to gain access to other appliances. This has low impact on confidentiality of the application, integrity and availability is not impacted.
Weakness: CWE-1004
Which versions are affected by CVE-2025-42909?
How do I fix CVE-2025-42909?
No fix has been published for CVE-2025-42909 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-42909 being exploited?
There is no known exploitation of CVE-2025-42909 in the wild and no public exploit code.
Sources
Also known as GHSA-5w45-p567-g3r4.