SAP CAL CVE-2025-42909

Exploitation requires that the attacker already hold HIGH privileges on an existing SAP Cloud Appliance Library (CAL) appliance, AND that the vulnerable insecure S/4HANA default profile setting be present in that appliance's configuration. The abuse pathway is this default profile misconfiguration, which enables lateral access to other CAL-provisioned appliances. Limiting factors per CVSS: authenticated high-privilege access is mandatory (PR:H), attack complexity is high (AC:H - conditions beyond the attacker's control must align), impact is confined to LOW confidentiality disclosure with no integrity or availability effect, and no user interaction is needed (UI:N). This is not remotely exploitable by an unauthenticated attacker against a default install.

This is a low-severity, low-priority issue (CVSS 3.1 base 3.0) despite its network attack vector. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N shows the critical mitigating factors: exploitation requires HIGH privileges (PR:H - an authenticated, highly privileged actor who already controls an existing SAP CAL appliance) AND high attack complexity (AC:H), with only LOW confidentiality impact and no integrity or availability impact. The scope-changed flag (S:C) is the one notable escalation, reflecting that the insecure S/4HANA default profile setting lets an already-privileged attacker pivot laterally to OTHER appliances beyond the initially compromised one. All exploitation signals align toward low real-world risk: EPSS is 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit code was identified. No SSVC decision record was provided in the input. The pre-conditions (existing high-privilege foothold plus specific default profile configuration) make this a hardening/defense-in-depth concern rather than an urgent patch priority. No key signals are conflicting; the main caveat is that reference links (SAP Note 3643871) are behind SAP authentication and could not be independently inspected.

An attacker who already holds high privileges on an existing SAP CAL appliance abuses the insecure S/4HANA default profile setting to reach and read limited data on other appliances provisioned through the same SAP Cloud Appliance Library environment. The scope-changed nature means the pivot crosses from the compromised appliance to separately managed ones. No public proof-of-concept exploit was identified, and the high complexity (AC:H) plus high-privilege prerequisite make opportunistic exploitation unlikely.