Introduction
Unauthorized access to SAP NetWeaver on IBM i-series can directly expose sensitive business data and administrative controls. Authentication bypasses in other enterprise platforms have recently led to data breaches and operational disruptions in several industries.
About SAP NetWeaver and IBM i-series:
- SAP is an enterprise software provider with over 400,000 customers worldwide. SAP NetWeaver is its core integration and application platform, and it supports ERP, CRM, and analytics for large organizations.
- IBM i-series (formerly AS/400) is a widely deployed enterprise server platform with a reputation for reliability, used in sectors such as finance, manufacturing, and government. It runs critical workloads and integrates closely with business applications like SAP.
Technical Information
CVE-2025-42958 is a critical vulnerability in SAP NetWeaver applications running on IBM i-series. It comes from a missing authentication check in the application logic. The application does not validate user credentials before it grants access to highly privileged or administrative functions. The flaw falls under CWE-250 (Execution with Unnecessary Privileges), which means some operations run with elevated permissions and without proper checks.
An attacker can exploit this by sending requests to network-accessible interfaces (such as web endpoints or RFC services) that do not enforce authentication. If the attack succeeds, an unauthorized user can:
- Read sensitive information
- Modify or delete business data
- Access or manipulate administrative features
The vulnerability affects all three security properties: confidentiality, integrity, and availability. No public code snippets or proof-of-concept details are available for it.
Affected Systems and Versions
- Product: SAP NetWeaver application
- Platform: IBM i-series (AS/400)
- Public advisories do not disclose specific version numbers or ranges as of the publication date.
- The issue affects only SAP NetWeaver deployments on IBM i-series.
Vendor Security History
SAP NetWeaver has had several critical vulnerabilities in 2025, including:
- CVE-2025-31324: Authentication bypass in Visual Composer
- CVE-2025-42999: Similar privilege escalation issue
IBM i-series platforms have also had privilege escalation and authentication flaws, such as:
- CVE-2025-33109: Privilege escalation due to invalid authority checks
- CVE-2025-3218: Authentication and authorization attack in IBM i NetServer
SAP publishes regular security updates and advisories, but the frequency of severe vulnerabilities in 2025 points to ongoing security problems at both vendors.
