What is the CVSS score of CVE-2025-42937?

CVE-2025-42937 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of SAP Print Service are affected by CVE-2025-42937?

A critical-severity flaw in SAP Print Service (SAPSprint) allows an attacker reaching the service to overwrite arbitrary files on the host, which can lead to full compromise of confidentiality,…

How to fix or mitigate CVE-2025-42937?

Within 24 hours, inventory every SAPSprint instance in the estate, determine which are reachable from untrusted networks or non-print subnets, and immediately restrict inbound access to SAPSprint listener ports (including LPD/515 and any dynamic spool ports) using host firewalls or network ACLs so that only authorized print servers can connect; where the service is not strictly required, stop and disable it. Within 7 days, apply the interim mitigations in the compensating controls field as a durable configuration baseline, enable and forward SAPSprint and host file-integrity logs to the SIEM with alerting on anomalous file writes and unexpected connections, confirm no indicators of exploitation (unexplained file changes, new accounts, modified SAP binaries) exist on exposed hosts, and open a case with SAP support to obtain the remediation timeline and any advance fix information. Within 30 days, track SAP Security Notes and the vendor advisory for this CVE weekly, and as soon as the vendor-released patch or note version covering SAPSprint is published, test it in a non-production environment and deploy to all affected systems, then verify the fix is in place before restoring any printing paths that were restricted; if SAP confirms that no fix will be issued for the deployed release, treat the compensating controls as permanent and schedule migration or decommissioning of the affected service.

SAP Print Service CVE-2025-42937

CRITICAL

Path Traversal: '.../...//' (CWE-35)

2025-10-14 cna@sap.com

Information Disclosure Path Traversal SAP

9.8

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network traversal (AV:N/PR:N/UI:N, AC:L) yielding arbitrary system-file overwrite gives full I:H/A:H and C:H via resulting compromise; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 11:40 vuln.today

tag: Path Traversal added

Analysis Generated

Oct 08, 2026 - 11:33 vuln.today

CVE Published

Oct 14, 2025 - 01:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availability of the application.

AnalysisAI

Path traversal in SAP Print Service (SAPSprint) allows unauthenticated remote attackers to overwrite arbitrary system files, potentially leading to complete compromise of confidentiality, integrity, and availability. The vulnerability is due to insufficient validation of user-supplied path information (CWE-35) and has a CVSS score of 9.8. No public exploit code has been identified at time of analysis, and the EPSS score is 0.74% (53rd percentile), indicating low likelihood of exploitation in the next 30 days; however, the impact is severe if the service is exposed to untrusted networks.

Technical ContextAI

SAP Print Service (SAPSprint) is a Windows-based print server component that receives print requests from SAP systems. The vulnerability lies in its failure to properly validate path information supplied by users, specifically allowing directory traversal via '../' sequences (CWE-35). An unauthenticated attacker with network access can send crafted requests that escape the intended directory and overwrite arbitrary files on the host. Because the service often runs with high privileges (e.g., LocalSystem), successful exploitation can lead to system compromise, data corruption, or denial of service. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that no authentication or user interaction is required, and the attack complexity is low.

Affected ProductsAI

The vulnerability affects SAP Print Service (SAPSprint) on Windows. All versions of SAPSprint that do not include the fix from SAP Security Note 3630595 are potentially vulnerable. Specific version ranges are not detailed in the available data; consult the SAP Security Note 3630595 (https://me.sap.com/notes/3630595) and the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday) for exact affected versions and patch levels. The service is typically deployed as part of SAP printing infrastructure on Windows servers.

RemediationAI

Apply the vendor-released patch referenced in SAP Security Note 3630595 (https://me.sap.com/notes/3630595) as soon as possible; the note provides the exact patch version and instructions. If immediate patching is not feasible, restrict network access to the SAPSprint listening port(s) to trusted internal networks or specific SAP application servers using firewall rules, as the vulnerability requires reachable network access. Additionally, run the SAPSprint service under a least-privilege account to limit the impact of file overwrites. Disabling the service if not required eliminates the risk. Monitor the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday) for updates.