CVE-2025-42925
Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)
- State
- Published
- Severity
- 4.3 Medium
- Published
- Sep 9, 2025
- Updated
- Sep 9, 2025
- Reserved
- Apr 16, 2025
Description
Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time, the attacker could determine a desired identifier which could enable them to access limited system information. This poses a low risk to confidentiality without impacting the integrity or availability of the service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | sap |
Weaknesses
- CWE-341 Predictable from Observable State
Affected Products
| Product | Versions |
|---|---|
SAP NetWeaver AS Java (IIOP Service)SAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.