CVE-2025-42890
Published: 11 November 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-42890, published on 2025-11-11, affects SQL Anywhere Monitor (Non-GUI), where hard-coded credentials (CWE-798) are baked into the code. This exposes resources and functionality to unintended users, enabling the possibility of arbitrary code execution with high impact on confidentiality, integrity, and availability. The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critical due to its network accessibility, low attack complexity, lack of prerequisites, and scope change.
Attackers can exploit this vulnerability remotely without privileges or user interaction. Exploitation allows arbitrary code execution, potentially leading to full system compromise across the affected environment.
SAP advisories provide mitigation guidance, including details in note 3666261 at https://me.sap.com/notes/3666261 and the SAP Security Patch Day page at https://url.sap/sapsecuritypatchday.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability involves hard-coded credentials in a network-accessible service (SQL Anywhere Monitor), enabling unauthenticated remote arbitrary code execution, directly mapping to exploitation of a public-facing application.