CVE-2021-27633

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCPIC() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS for ABAP (RFC Gateway)	< KRNL32NUC - 7.22; < 7.22EXT; < KRNL64NUC - 7.22; < 7.49; < KRNL64UC - 8.04; < 7.22; < 7.53; < 7.73; < KERNEL - 7.22; < 8.04; < 7.77; < 7.81; < 7.82; < 7.83

References

https://launchpad.support.sap.com/#/notes/3020209Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999Broken Link, Vendor Advisory
https://launchpad.support.sap.com/#/notes/3020209Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999Broken Link, Vendor Advisory

Timeline

Published: Jun 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-276345.9SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.CVE-2021-276356.5SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a n CVE-2021-276374.6Under certain conditions SAP Enable Now (SAP Workforce Performance Builder - Manager), versions - 1.0, 10 allows an attacker to access infor CVE-2021-276385.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in cra CVE-2021-276395.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in cra CVE-2021-276405.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in cr CVE-2021-276415.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in cr CVE-2021-276425.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in cr CVE-2021-276435.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in cr CVE-2021-276448.8In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQ CVE-2021-276452.5The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup loo CVE-2021-276469.8Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers