CVE-2025-23189

The vulnerability resides in the SDCCN transaction of SAP systems, where an RFC-enabled function module lacks sufficient authorization checks. As described in the official advisory, an authenticated attacker can exploit this missing authorization to generate technical metadata without proper validation [1].

Exploitation requires prior authentication to the SAP system, but does not need special administrative privileges. The attacker can invoke the vulnerable RFC function module remotely, as RFC-enabled modules are accessible over the network, making the attack surface broad for any authenticated user.

The impact is limited to low integrity loss, as the attacker can generate metadata that may be tampered with or falsified. The vulnerability does not affect confidentiality or availability, meaning no data disclosure or service disruption is expected [1].

SAP has released security notes as part of its monthly Security Patch Day to address this issue. Administrators should apply the relevant patches based on their support package stack, following the guidance in SAP Security Notes [1].