What is the CVSS score of CVE-2025-42954?

CVE-2025-42954 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of SAP are affected by CVE-2025-42954?

CVE-2025-42954 is a low-severity vulnerability in SAP NetWeaver Business Warehouse CCAW application (CVSS 2.7).

How to fix or mitigate CVE-2025-42954?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

SAP CVE-2025-42954

EUVD-2025-20351 LOW

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2025-07-08 cna@sap.com

SAP Denial Of Service

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20351

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 01:15 nvd

LOW 2.7

DescriptionCVE.org

SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected resource. This leads to low impact on availability of the application, there is no impact on confidentiality and integrity.

Analysis

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835).