CVE-2014-0984: SAP Router

Medium severity, CVSS 4.3. EPSS: 2.7% chance of exploitation in the next 30 days.

The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.

Affected products

• SAP Router: version 710 only; version 720 only; version 721 only

Published 2014-04-17. Last modified 2026-06-17.