cbcvebase.
CVE-2021-27597
published 2021-06-09

CVE-2021-27597: SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73…

PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.51%
71.6th percentile
SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method memmove() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Affected

30 ranges· showing 25
VendorProductVersion rangeFixed in
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sapnetweaver_abap——
sap_sesap_netweaver_as_for_abap< KRNL32NUC - 7.22KRNL32NUC - 7.22
sap_sesap_netweaver_as_for_abap< 7.22EXT7.22EXT
sap_sesap_netweaver_as_for_abap< KRNL64NUC - 7.22KRNL64NUC - 7.22
sap_sesap_netweaver_as_for_abap< 7.497.49
sap_sesap_netweaver_as_for_abap< KRNL64UC - 8.04KRNL64UC - 8.04
sap_sesap_netweaver_as_for_abap< 7.227.22
sap_sesap_netweaver_as_for_abap< 7.537.53
sap_sesap_netweaver_as_for_abap< 7.737.73
sap_sesap_netweaver_as_for_abap< KERNEL - 7.22KERNEL - 7.22

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.