CVE Alert: CVE-2025-42940 – SAP_SE – SAP CommonCryptoLib

Risk verdict

High risk: a pre-authentication, network-exposed memory-corruption flaw could crash the service and disrupt availability; KEV/SSVC/EPSS data are not provided, so treat as priority 1 if exploitation intelligence confirms active use.

Why this matters

In SAP environments, outages can halt critical business processes and finance operations. An attacker could remotely induce a crash without user interaction or credentials, achieving DoS without compromising confidentiality or integrity, potentially cascading across interconnected systems.

Most likely attack path

Attack requires network access to the vulnerable component, with no privileges and no user interaction. Exploitation would cause memory corruption with an unchanged scope, enabling remote DoS. Lateral movement is unlikely unless other exposed interfaces exist, but the primary risk is remote service disruption.

Who is most exposed

organisations with network-accessible SAP components, including on-prem and cloud deployments, especially where remote access or wide trust boundaries expose core services.

Detection ideas

• Frequent crash logs or dump files linked to the library after ASN.1 parsing activity.
• Network traces showing pre-auth ASN.1 manipulation directed at the service.
• Unusual spikes in unauthenticated connection attempts to the affected port.
• Post-event service restarts or crashes without user action.
• Correlation of crashes with specific ASN.1 payload patterns in logs.

Mitigation and prioritisation

• Apply the vendor’s patched library version; verify in a staging environment before production rollout.
• Immediately reduce exposure: restrict network access, implement strict ACLs, and segment SAP components from untrusted networks.
• If patching is delayed, enable compensating controls (firewall/WAF rules, monitor for unauthorised parsing activity, disable non-essential ASN.1 parsing paths).
• Enhance incident response readiness: collect crash dumps, set up alerting for memory faults, and review change-management plans.
• If KEV true or EPSS ≥ 0.5, treat as priority 1.