CVE-2025-42892
MediumCVSS 6.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
An OS Command Injection vulnerability exists in SAP Business Connector. An authenticated attacker with administrative access and adjacent network access could upload specially crafted content that, when processed, enables execution of arbitrary operating system commands.
Risk Assessment
Successful exploitation could lead to full compromise of the system's confidentiality, integrity, and availability.
Recommendation
Apply available SAP Business Connector updates and restrict administrative and network access to the minimum necessary.
Other vulnerabilities in SAP Business Connector
See all- CVE-2025-42894Medium
Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system.
- CVE-2025-42893Medium
Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.
- CVE-2025-42886Medium
SAP Business Connector contains a Reflected Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can create a malicious link and make it publicly accessible. When an authenticated victim opens the link, the injected input executes in their browser.
Original NVD description (English source)
Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating system commands. Successful exploitation could lead to full compromise of the system�s confidentiality, integrity, and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS