What is CVE-2025-42954?

CVE-2025-42954 is a low-severity vulnerability in Sap Se Netweaver Business Warehouse (Ccaw Application), classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 2.7/10. Published 2025-07-08.

How severe is CVE-2025-42954?

Low severity. CVSS v3 base score is 2.7 out of 10.

Vulnerability in Sap Se Netweaver Business Warehouse (Ccaw Application)

CVE-2025-42954

SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected resource. This leads to low impact on availability of the application, there is no impact on confidentiality and integrity.

EPSS: 0.004 (31.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L.

Affected products

Sap_se Sap Netweaver Business Warehouse (Ccaw Application) — versions DW4CORE 100, 200, 300

Weakness classification (CWE)

CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop)

References

Frequently asked questions

What is CVE-2025-42954?: CVE-2025-42954 is a low-severity vulnerability in Sap Se Netweaver Business Warehouse (Ccaw Application), classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 2.7/10. Published 2025-07-08.
How severe is CVE-2025-42954?: Low severity. CVSS v3 base score is 2.7 out of 10.