Vulnerability in SAP Web Dispatcher and ICM Leads to Unauthorized Access
CVE-2025-42878
Key Information:
- Vendor
SAP
- Vendor
- CVE Published:
- 9 December 2025
What is CVE-2025-42878?
The SAP Web Dispatcher and ICM have a vulnerability that may inadvertently expose internal testing interfaces that should not be accessible in a production environment. When these interfaces are enabled, they can be exploited by unauthenticated attackers, allowing them to access sensitive diagnostic information, send specially crafted requests, or potentially disrupt service availability. This poses significant risks to confidentiality and availability, highlighting the importance of securing such interfaces to protect organizations from potential attacks.
Affected Version(s)
SAP Web Dispatcher and Internet Communication Manager (ICM) KRNL64NUC 7.22
SAP Web Dispatcher and Internet Communication Manager (ICM) 7.22EXT
SAP Web Dispatcher and Internet Communication Manager (ICM) KRNL64UC 7.22