Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:HSummary
CVE-2025-42874 is a high-severity Amplification (CWE-405) vulnerability in Sap (inferred from references). Its CVSS base score is 7.9 (High).
Operationally, ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201853
Vulnerability Data
SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls. Exploitation does not require user…
more
interaction and could lead to service disruption or unauthorized system control. This has high impact on integrity and availability, with no impact on confidentiality.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the remote service, blocking the insufficient input validation that enables arbitrary code execution via crafted method calls.
Restricts the high privileges required for exploitation, limiting the accounts that can reach the vulnerable remote method handling path.
Enforces boundary protection and traffic filtering to block unauthorized network access to the exposed Xcelsius remote service.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Resilience mechanisms such as rate limiting and load balancing directly constrain asymmetric resource use.
Capacity planning and monitoring maintain availability headroom against amplification attacks.
Network monitoring detects amplification traffic patterns but does not itself limit asymmetric consumption.
Runtime resource monitoring can surface excessive consumption yet does not enforce authorization or work proofs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Stress-testing and demand-reduction tactics (e.g., bandwidth throttling) blunt amplification vectors that would otherwise let an attacker multiply resource consumption through a single request.