CVE-2008-6737: Ea Crysis

High severity, CVSS 7.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Crysis 1.21 and earlier allows remote attackers to obtain sensitive player information such as real IP addresses by sending a keyexchange packet without a previous join packet, which causes Crysis to send a disconnect packet that includes unrelated log information.

Affected products

• Ea Crysis: up to and including 1.21; version 1.1 only; version 1.2 only

Published 2009-04-21. Last modified 2026-06-16.