CVE-2021-27633 | Vulnetix

CVE-2021-27633 PUBLISHED CVSS 7.5 HIGH

Reported by sap · Published June 9, 2021

SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCPIC() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Risk scores

CVSS 3.0

7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS for ABAP (RFC Gateway)	< KRNL32NUC - 7.22, < 7.22EXT, < KRNL64NUC - 7.22
SAP SE	SAP NetWeaver AS for ABAP (RFC Gateway)	0, 0, 0

Timeline

Jun 8, 2021 CVE Published
Jun 10, 2021 EPSS Score (30 in total, the first dated here)
Apr 4, 2026 Security Advisory
Aug 6, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2021-27633
vulnetix vdb fixes CVE-2021-27633

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-27633/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →