CVE-2022-27668

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP_ROUTER 7.53, 7.22, from a remote client, for example stopping the SAProuter, that could highly impact systems availability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver and ABAP Platform	KERNEL 7.49; 7.77; 7.81; 7.85; 7.86; 7.87; 7.88; KRNL64NUC 7.49; KRNL64UC 7.49; SAP_ROUTER 7.53; 7.22

References

http://packetstormsecurity.com/files/168406/SAP-SAProuter-Improper-Access-Control.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2022/Sep/17Exploit, Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/3158375Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
http://packetstormsecurity.com/files/168406/SAP-SAProuter-Improper-Access-Control.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2022/Sep/17Exploit, Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/3158375Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Jun 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-276697.5An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to whic CVE-2022-27676.1A vulnerability classified as problematic has been found in SourceCodester Online Admission System. This affects an unknown part of the file CVE-2022-276706.5SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server CVE-2022-276716.5A CSRF token visible in the URL may possibly lead to information disclosure vulnerability.CVE-2022-276724.7When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode CVE-2022-276737.5Insufficient access controls in the AMD Link Android app may potentially result in information disclosure.CVE-2022-276747.5Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to a CVE-2022-276777.8Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentiall CVE-2022-27686.1A vulnerability classified as problematic was found in SourceCodester Library Management System. This vulnerability affects unknown code of CVE-2022-27695.4A vulnerability, which was classified as problematic, has been found in SourceCodester Company Website CMS. This issue affects some unknown CVE-2022-27709.8A vulnerability, which was classified as critical, was found in SourceCodester Simple Online Book Store System. Affected is an unknown funct CVE-2022-27719.8A vulnerability has been found in SourceCodester Simple Online Book Store System and classified as critical. Affected by this vulnerability