NVD Last Modified: 11/12/2025
Preface: The original graphical interface for the SQL Anywhere Monitor relied on Adobe Flash, which reached its end-of-life in December 2020. Consequently, the GUI interface is no longer provided in modern versions, and users must use non-GUI methods. SAP recommends using SAP SQL Anywhere Cockpit or SAP Solution Manager as modern, supported tools to replace the legacy SQL Anywhere Monitor for comprehensive monitoring requirements.
Background: Sybase SQL Anywhere (now renamed SAP SQL Anywhere) allows hardcoding credentials in various profiles, connection strings, and scripts, but this poses serious security risks and is strongly discouraged. Passwords stored in this way are typically in plaintext or only slightly obfuscated, making them easily accessible to unauthorized users.
ODBC Data Sources (DSNs): The Windows ODBC Data Source Administrator allows saving the username and password in the DSN configuration.
Ref: SAP SQL Anywhere has historically been a popular choice for specific use cases due to its strengths in embedded and mobile applications with intermittent connectivity. However, its overall market popularity has declined, and it is generally considered a legacy system, with mainstream maintenance ending in the near future (around 2028).
Vulnerability details: SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system.
Official announcement: Please refer to the link for details –