Predictable Identifier Vulnerability in SAP NetWeaver AS JAVA IIOP Service

CVE-2025-42925

What is CVE-2025-42925?

A predictable identifier vulnerability exists in the SAP NetWeaver AS JAVA IIOP service due to insufficient randomness in Object Identifier assignment. An attacker with low privileges, by using a brute force approach, may generate identifiers in close proximity to derive useful information. This flaw could allow the attacker to access limited system details, potentially undermining security without affecting system integrity or availability. Immediate attention is recommended for systems running the affected versions to mitigate any associated risks.

References