CVE-2025-42878
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H
- EPSS probability
- 0.36%
- CWE
- CWE-1244
- Published
- 2025-12-09
- Last modified
- 2026-03-13
Affected products
- SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)
- SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)
- SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)
- SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)
- SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)
- SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)
- SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)
- SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)
Weakness type
Related vulnerabilities
- CVE-2026-8989 — Open Recovery Mode
- CVE-2025-67862 — An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244]...
- CVE-2025-36755 — CleverDisplay BlueOne unauthorized BIOS access through physical USB keyboard
- CVE-2025-23337 — NVIDIA HGX & DGX GB200, GB300, B300 contain a vulnerability in the HGX Management Controller (HMC)...
- CVE-2025-23302 — NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an...
- CVE-2025-23301 — NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an...
- CVE-2025-20238 — A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco...
- CVE-2025-23252 — The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to...