CVE-2025-42979
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive of this user�s windows registry could recreate the original password. There is no impact on integrity or availability of the application
Reserved 2025-04-16 | Published 2025-07-08 | Updated 2025-07-08 | Assigner sapCWE-922: Insecure Storage of Sensitive Information
Support options
