Sap Netweaver And Sap Web Dispatcher Internet Communication Manager
Monthly
Unauthenticated remote denial of service affects SAP NetWeaver and SAP Web Dispatcher deployments in which the Internet Communication Manager (ICM) internal protocol component can be reached by an attacker; a specially crafted request carrying invalid field values triggers an integer underflow (CWE-191) that corrupts memory handling and crashes the affected process. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning any network-reachable instance is exposed with no credentials or user interaction required, but the consequence is strictly service disruption - there is no confidentiality or integrity impact and no demonstrated path to data disclosure, tampering, or code execution. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the practical risk driver is therefore exposure of the ICM/Web Dispatcher protocol endpoint rather than active exploitation, with internet-facing systems materially more at risk than segmented internal ones.
Unauthenticated remote denial of service affects SAP NetWeaver and SAP Web Dispatcher deployments in which the Internet Communication Manager (ICM) internal protocol component can be reached by an attacker; a specially crafted request carrying invalid field values triggers an integer underflow (CWE-191) that corrupts memory handling and crashes the affected process. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning any network-reachable instance is exposed with no credentials or user interaction required, but the consequence is strictly service disruption - there is no confidentiality or integrity impact and no demonstrated path to data disclosure, tampering, or code execution. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the practical risk driver is therefore exposure of the ICM/Web Dispatcher protocol endpoint rather than active exploitation, with internet-facing systems materially more at risk than segmented internal ones.