CVE-2025-24870: Insecure Key & Secret Management vulnerability in SAP GUI for Windows
SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulting in privilege escalation. On successful exploitation, this could result in disclosure of highly sensitive information. This has no impact on integrity, and availability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24870?
CVE-2025-24870 has been classified as a high severity vulnerability due to the potential for privilege escalation and sensitive information disclosure.
How do I fix CVE-2025-24870?
To mitigate the risks associated with CVE-2025-24870, update to the latest version of SAP GUI for Windows that addresses this vulnerability.
What impact does CVE-2025-24870 have on my systems?
CVE-2025-24870 could allow an unauthenticated attacker to access sensitive service credentials, leading to unauthorized access and privilege escalation.
Which versions of SAP GUI for Windows are affected by CVE-2025-24870?
CVE-2025-24870 affects certain versions of SAP GUI for Windows, so it is essential to check for updates from the vendor.
Is CVE-2025-24870 being actively exploited?
As of now, there have been no confirmed reports of active exploitation of CVE-2025-24870, but it is crucial to apply security patches promptly.