Riskcovery

CVE-2025-42950

Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)

State
Published
Severity
9.9 Critical
Published
Aug 12, 2025
Updated
Feb 26, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Scores

CVSSScoreVectorSource
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsap

Weaknesses

  • CWE-94 Improper Control of Generation of Code

Affected Products

ProductVersions
SAP Landscape Transformation (Analysis Platform)SAP_SE
  • DMIS 2011_1_700Affected
  • 2011_1_710Affected
  • 2011_1_730Affected
  • 2011_1_731Affected
  • 2011_1_752Affected
  • 2020Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.