CVE-2007-1917
Buffer overflow in the SYSTEM_CREATE_INSTANCE function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This in...
Affects 11 products across 8 vendors.
A critical buffer overflow vulnerability exists in the SYSTEM_CREATE_INSTANCE function of the SAP RFC Library versions 6.40 and 7.00 prior to 20061211. This flaw allows remote attackers to execute arbitrary code, posing significant risks to affected systems.
BSID: BS-2007-GLOBAL-017584-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2007-1917?
What is the CVSS score for CVE-2007-1917?
Is CVE-2007-1917 actively exploited?
How do I remediate CVE-2007-1917?
What systems are affected by CVE-2007-1917?
What NERC-CIP standard applies to CVE-2007-1917?
What IEC 62443 requirement maps to CVE-2007-1917?
| CVE ID | CVE-2007-1917 |
|---|---|
| BSID | BS-2007-GLOBAL-017584-C BreachSpider Global ID |
| CVSS Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Published | 2007-04-10 |
| Last Modified | 2026-06-16 |
| ICS Relevance | 55% |
| Verticals | |
| Source | NVD |
Buffer overflow in the SYSTEM_CREATE_INSTANCE function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
Source: NIST NVD / MITRE CVE Database
The vulnerability can be exploited by sending specially crafted requests to the SYSTEM_CREATE_INSTANCE function in the SAP RFC Library. The buffer overflow occurs due to insufficient input validation, allowing an attacker to overwrite memory and potentially execute arbitrary code.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Sap | Rfc Library | 6.4 7.0 |
Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Apple Macos, Hp Hp-Ux, Hp Tru64, Ibm Os 400, Ibm Aix, Ibm Racf, Linux Linux Kernel, Microsoft Windows Server, Siemens Reliant Unix, Sun Solaris
No patch URL on record. Monitor vendor security advisories directly.
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement network segmentation and restrict access to the SAP RFC Library to trusted sources only.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 as it allows unauthorized access to electronic security perimeters, which could compromise the integrity and availability of critical assets.
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited remotely, leading to potential loss of control and data integrity in industrial control systems.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 96cea93544b8d50247d3c994e5ab6ac46da6800bd85f680471b8745496df8a9586d9f456877451041b279a8d6367b68e286ca72dee38bd4339917c82a620fc9b |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →