Vulnerability · Published Nov 11, 2025 · Assigned by sap
CVE-2025-42890Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)
Critical 10.0
In plain English
A critical-severity hard-coded credentials in SQL Anywhere Monitor (Non-Gui) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.7%top 47.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SQL Anywhere Monitor (Non-Gui) | SYBASE_SQL_ANYWHERE_SERVER 17.0 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H