Introduction
A critical ABAP code injection flaw in SAP Landscape Transformation (SLT) lets an attacker with standard user access fully compromise the system. The attacker can bypass core authorization checks and set up persistent backdoor access, which puts the confidentiality, integrity, and availability of business-critical SAP systems at risk.
About SAP and SLT: SAP SE is one of the largest vendors in the enterprise software market, with over 440,000 customers worldwide. SAP Landscape Transformation (SLT) handles real-time data replication and integration across SAP landscapes, and many large organizations run business-critical operations on it.
Technical Information
CVE-2025-42950 is a code injection vulnerability (CWE-94) in SAP Landscape Transformation (SLT) that affects function modules exposed via Remote Function Call (RFC). It comes from insufficient input validation and missing authorization checks in specific RFC-enabled function modules. An authenticated user can supply crafted input that the module then incorporates dynamically into ABAP code at execution time.
The vulnerable function module does not sanitize or validate user-supplied data before it uses that data in dynamically constructed ABAP statements, so an attacker can inject arbitrary ABAP code. The injected code runs with system-level privileges and bypasses standard SAP authorization mechanisms. The results are:
- Arbitrary code execution
- Full system compromise
- Potential for persistent backdoor creation
- Manipulation of business processes and data
Any authenticated user with RFC access to the affected function module can exploit the vulnerability, which lowers the barrier to exploitation significantly. The root cause is improper handling of user-controlled input in the ABAP runtime, specifically in RFC-exposed modules within SLT.
Affected Systems and Versions
- Product: SAP Landscape Transformation (SLT)
- Vulnerable component: Function modules exposed via RFC
- Affected versions: The available sources do not list specific versions. See SAP Security Note 3633838 for the affected version ranges and patch applicability.
- Vulnerable configuration: Any SAP SLT system that exposes the affected function modules via RFC to authenticated users
Vendor Security History
SAP has had several critical vulnerabilities in 2025, including:
- CVE-2025-31324 (NetWeaver Visual Composer unrestricted file upload, CVSS 10.0)
- CVE-2025-31330 (SLT code injection, CVSS 9.9)
- CVE-2025-27429 (S/4HANA code injection, CVSS 9.9)
- CVE-2025-42999 (NetWeaver Visual Composer deserialization, CVSS 9.1)
SAP typically issues security patches monthly and has released out-of-cycle advisories for actively exploited vulnerabilities. The repeated code injection and deserialization flaws point to ongoing problems in its secure development and code review processes.
