CVE-2025-0066
Published: 14 January 2025
Summary
CVE-2025-0066 is a critical-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Sap Sap Basis. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations for access to information and resources, addressing the weak access controls that enable unauthorized access to restricted information in SAP NetWeaver ICF.
Employs least privilege to restrict access to only necessary permissions, mitigating CWE-732 incorrect permission assignments exploited by low-privileged attackers.
Requires timely remediation of identified flaws, including applying SAP patches from Note 3550708 to fix the specific access control vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Weak access controls in public-facing ICF component directly enable remote exploitation of the application (T1190) by low-privileged attackers, resulting in unauthorized access and effective privilege escalation to full compromise (T1068).
NVD Description
Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an…
more
application
Deeper analysisAI
CVE-2025-0066 affects SAP NetWeaver AS for ABAP and ABAP Platform, specifically the Internet Communication Framework component. The vulnerability arises from weak access controls under certain conditions, enabling an attacker to access restricted information. This issue, published on 2025-01-14, carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is linked to CWE-732 (Incorrect Permission Assignment for Critical Resource), with potential significant impacts on the confidentiality, integrity, and availability of affected applications.
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. The high scope (S:C) amplifies the impact, allowing achievement of high confidentiality, integrity, and availability effects, potentially leading to full compromise of the targeted application.
SAP advisories provide mitigation guidance, including details in Note 3550708 (https://me.sap.com/notes/3550708) and the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday). Security practitioners should review these references for applicable patches and remediation instructions.
Details
- CWE(s)