CVE-2025-42943 - CVE House

Back to Database

Status published Medium CVE-2025-42943

Information Disclosure in SAP GUI for Windows

4.5 CVSS

Vulnerability Description

SAP GUI for Windows may allow the leak of NTML hashes when specific ABAP frontend services are called with UNC paths. For a successful attack, the attacker needs developer authorization in a specific Application Server ABAP to make changes in the code, and the victim needs to execute by using SAP GUI for Windows. This could trigger automatic NTLM authentication, potentially exposing hashed credentials to an attacker. As a result, it has a high impact on the confidentiality.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-42943

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from SAP_SE

View All →

Missing Authorization Check in SAP Landscape Transformation (PCL Basis)

Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

Missing Authorization check in SAP Service Parts Management (SPM)

Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal

Missing Authorization check in SAP Service Parts Management (SPM)

Affected Vendor

SAP_SE

View all reports →

Affected Software

SAP GUI for Windows

Vulnerable Versions:

BC-FES-GUI 8.00

Timeline

Official Publish: August 12th, 2025

Last Modified: August 12th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Defense Evasion

T1078 Valid Accounts

T1574 Hijack Execution Flow

Privilege Escalation

T1485 Data Destruction