CVE-2016-6147

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-08-05 · updated 2026-06-17
Weakness: CWE-78

Description

An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via unspecified vectors, aka SAP Security Note 2234226.

Affected products

SAP Trex: 7.10-revision_63

References

http://packetstormsecurity.com/files/138446/SAP-TREX-7.10-Revision-63-Remote-Command-Execution.html
http://seclists.org/fulldisclosure/2016/Aug/94
http://www.securityfocus.com/bid/92066
https://www.onapsis.com/blog/analyzing-sap-security-notes-february-2016
https://www.onapsis.com/research/security-advisories/sap-trex-remote-command-execution-0
http://packetstormsecurity.com/files/138446/SAP-TREX-7.10-Revision-63-Remote-Command-Execution.html
http://seclists.org/fulldisclosure/2016/Aug/94
http://www.securityfocus.com/bid/92066
https://www.onapsis.com/blog/analyzing-sap-security-notes-february-2016
https://www.onapsis.com/research/security-advisories/sap-trex-remote-command-execution-0

Get alerted when CVE-2016-6147 or the next vulnerability affects your stack