SAP 6.4 before 6.40 patch 4, 6.2 before 6.20 patch 1364, 4.6 before 4.6D patch 1767, 45…
Priority LOW 38Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
SAP 6.4 before 6.40 patch 4, 6.2 before 6.20 patch 1364, 4.6 before 4.6D patch 1767, 45 before 45B patch 913, 40 before 40B patch 1008, and 31 before 31I patch 735 do not properly restrict process execution by lnaxdm/sapsys, which allows remote attackers to execute arbitrary code via a certain UDP packet that ends with the name of a local executable file, aka the "FX SAP R/3 gwrd vuln."
Why it matters now
EPSS 0.02645 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:sap_r_3:4.6_before_patch_1767:*:*:*:*:*:*:* | 4.6_before_patch_1767 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_r_3:6.2_before_patch_1364:*:*:*:*:*:*:* | 6.2_before_patch_1364 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_r_3:6.4_before_patch_4:*:*:*:*:*:*:* | 6.4_before_patch_4 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_r_3:31_before_31i_patch_735:*:*:*:*:*:*:* | 31_before_31i_patch_735 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_r_3:40_before_patch_1008:*:*:*:*:*:*:* | 40_before_patch_1008 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_r_3:45_before_patch_913:*:*:*:*:*:*:* | 45_before_patch_913 | Vulnerable | SAP |
- cpe:2.3:a:sap:sap_r_3:4.6_before_patch_1767:*:*:*:*:*:*:* Versions 4.6_before_patch_1767 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_r_3:6.2_before_patch_1364:*:*:*:*:*:*:* Versions 6.2_before_patch_1364 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_r_3:6.4_before_patch_4:*:*:*:*:*:*:* Versions 6.4_before_patch_4 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_r_3:31_before_31i_patch_735:*:*:*:*:*:*:* Versions 31_before_31i_patch_735 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_r_3:40_before_patch_1008:*:*:*:*:*:*:* Versions 40_before_patch_1008 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_r_3:45_before_patch_913:*:*:*:*:*:*:* Versions 45_before_patch_913 Vulnerable ·SAP
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2005-4815
- 2026-10-03 Alias added: GHSA-2qff-4q86-c9p7
References
More Sap R 3 vulnerabilities
- TI-2002-01500 The default installation of SAP R/3, when using Oracle and SQL*net V2 3.x, 4.x, and 6.10… CVSS 2.0HIGH 7.5
- TI-2003-00940 The default installation of SAP R/3 46C/D allows remote attackers to bypass account… CVSS 2.0HIGH 7.5
- TI-2002-01499 SAP R/3 2.0B to 4.6D installs several clients with default users and passwords, which… CVSS 2.0HIGH 7.5
- TI-2005-01599 Directory traversal vulnerability in Internet Graphics Server in SAP before 6.40 Patch 11… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2005-4815 · CVE Program
- CVE-2005-4815 · NVD
- FIRST EPSS
- GHSA-2qff-4q86-c9p7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences