Back
CVE-2025-42878
Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)
High8.2EPSS 0.36%
- Published
- Updated
- Reserved
- Assigned by
- sap
Description
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| sapCNA (assigner) | 3.1 | High8.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H |
| NVDNVD · Deferred | 3.1 | High8.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H |
- EPSS (exploitation in 30 days)
- 0.36% · top 70% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.
Weakness
Affected products
SAP_SE · SAP Web Dispatcher and Internet Communication Manager (ICM)
- affected KRNL64NUC 7.22
- affected 7.22EXT
- affected KRNL64UC 7.22
- affected 7.53
- affected WEBDISP 7.22_EXT
- affected 7.54
- affected 7.77
- affected 7.89
- affected 7.93
- affected 9.16
- affected KERNEL 7.22
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-42878)Record last updated .