SAP’s January 2025 Security Updates: Addressing Critical Vulnerabilities in NetWeaver Application Servers

Overview of SAP’s January 2025 Security Patch Day

On January 14, 2025, SAP released a series of security notes as part of its monthly Security Patch Day, focusing on critical vulnerabilities within its NetWeaver Application Servers. citeturn0search4 These vulnerabilities, if left unaddressed, could allow unauthorized access, privilege escalation, and significant compromise of system confidentiality, integrity, and availability.

Critical Vulnerabilities Identified

CVE-2025-0070: Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform

Severity: Critical (CVSS Score: 9.9)

Description: This vulnerability arises from improper authentication checks within the SAP NetWeaver Application Server for ABAP and the ABAP Platform. An authenticated attacker can exploit this flaw to escalate privileges, potentially gaining unauthorized access to sensitive information and critical system functions. citeturn0search4

CVE-2025-0066: Information Disclosure in SAP NetWeaver AS for ABAP and ABAP Platform

Severity: Critical (CVSS Score: 9.9)

Description: This information disclosure vulnerability exists within the Internet Communication Framework of SAP NetWeaver AS for ABAP and ABAP Platform. Due to weak access controls, an attacker can access restricted information, leading to a significant compromise of system confidentiality, integrity, and availability. citeturn0search4

CVE-2025-0063: SQL Injection Vulnerability in SAP NetWeaver

Severity: High (CVSS Score: 8.8)

Description: This SQL injection vulnerability allows an attacker to manipulate database queries, potentially leading to unauthorized data access or modification. Exploitation of this flaw could result in a complete compromise of the affected system’s confidentiality, integrity, and availability. citeturn0search1

Impact on SAP Systems

The identified vulnerabilities pose significant risks to organizations utilizing SAP NetWeaver Application Servers. Exploitation could lead to unauthorized access, data breaches, and disruption of critical business processes. Given the high severity ratings, it is imperative for organizations to assess their systems promptly and apply the necessary patches to mitigate potential threats.

Recommended Actions

SAP strongly advises customers to:

• Apply Patches Immediately: Access the SAP Support Portal to download and implement the latest security patches corresponding to the identified vulnerabilities. citeturn0search4
• Review System Configurations: Ensure that all systems are configured according to SAP’s security guidelines to prevent potential exploitation.
• Monitor Systems for Unusual Activity: Implement continuous monitoring to detect any anomalous behavior that may indicate attempted exploitation of these vulnerabilities.

Conclusion

The January 2025 Security Patch Day underscores SAP’s commitment to maintaining the security and integrity of its products. Organizations are urged to act swiftly in applying the recommended patches and reviewing their security measures to safeguard against potential threats arising from these critical vulnerabilities.