CVE-2025-42959 — Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476
An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific security patches, is re…
Published: 2025-07-08 · CVSS: 8.1 · CVSS 3.1
An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation could result in complete system compromise, affecting confidentiality, integrity, and availability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7