BaseFortify

Publication date: 2025-11-11

Last updated on: 2025-11-12

Assigner: SAP SE

Description

SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-11

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-42890

Affected Vendors & Products

Vendor	Product	Version / Range
sap	sql_anywhere	3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves SQL Anywhere Monitor (Non-GUI) having baked-in credentials within its code. These hardcoded credentials can be exploited by attackers to access resources or functionality that should be restricted, potentially allowing them to execute arbitrary code on the affected system.

Impact Analysis

The vulnerability can have a high impact on the confidentiality, integrity, and availability of the system. Attackers exploiting this issue could gain unauthorized access, execute arbitrary code, and potentially disrupt or manipulate system operations.

Hi! I’m here to help you understand CVE-2025-42890. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70