CVE-2025-0066

CVE-2025-0066 affects SAP NetWeaver AS for ABAP and ABAP Platform, specifically the Internet Communication Framework component. The vulnerability arises from weak access controls under certain conditions, enabling an attacker to access restricted information. This issue, published on 2025-01-14, carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is linked to CWE-732 (Incorrect Permission Assignment for Critical Resource), with potential significant impacts on the confidentiality, integrity, and availability of affected applications.

An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. The high scope (S:C) amplifies the impact, allowing achievement of high confidentiality, integrity, and availability effects, potentially leading to full compromise of the targeted application.

SAP advisories provide mitigation guidance, including details in Note 3550708 (https://me.sap.com/notes/3550708) and the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday). Security practitioners should review these references for applicable patches and remediation instructions.