Medium severity · published Feb 11, 2025
CVE-2025-24870
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulting in privilege escalation. On successful exploitation, this could result in disclosure of highly sensitive information. This has no impact on integrity, and availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
SAP GUI for Windows · SAP_SE
BC-FES-GUI 8.00 · source: vendor
Affected product
SG
SAP GUI for Windows
SAP_SE
More from SAP GUI for Windows
6.0
CVE-2025-0055
Information Disclosure vulnerability in SAP GUI for Windows
5.6
CVE-2025-42979
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
5.5
CVE-2025-42888
Information Disclosure vulnerability in SAP GUI for Windows
4.5
CVE-2025-42943
Information Disclosure in SAP GUI for Windows
4.3
CVE-2025-43005
Information Disclosure vulnerability in SAP GUI for Windows