CVE-2025-42979CWE-922

Insecure Key & Secret Management vulnerability in SAP GUI for Windows

Medium · published July 8, 2025

CVSS v3.1
5.6
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive of this user�s windows registry could recreate the original password. There is no impact on integrity or availability of the application

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00145 · 3.4th percentile
Weakness
CWE-922 · Insecure Storage of Sensitive Information
Published
2025-07-08T00:37Z
EPSS history
Timeline
  • 08 JUL 00:37Z
    Insecure Key & Secret Management vulnerability in SAP GUI for Windows
    cvelistv5