CVE-2023-27267 in the critical feed json
Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)
published 2023-04-11 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-31045
- cvss
- 9.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.2%
- EPSS 14.2% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
14.20% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- SAP Diagnostics Agent (OSCommand Bridge)
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
sap.com
/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
vendor-advisory
-
launchpad.support.sap.com
/#/notes/3305369
permissions-required
Sources
- CVE List CVE-2023-27267
- NVD CVE-2023-27267
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.