Cyber Resilience

CVE-2024-54198

Published
10 December 2024
Modified
15 April 2026
CVSS Score v3.1 8.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0061 46th percentile
Risk Priority 60 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-54198 is a high-severity Improper Control of Dynamically-Identified Variables (CWE-914) vulnerability in Sap (inferred from references). Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Manipulation (T1565); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further…

more

exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.

CWE(s)
CWE-914

Related Threats

MITRE ATT&CK Enterprise Techniques

T1565 Data Manipulation Impact
Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-24914Shared CWE-914
CVE-2026-35173Shared CWE-914
CVE-2023-33175Shared CWE-914
CVE-2025-14085Shared CWE-914
CVE-2025-14051Shared CWE-914
CVE-2026-44006Shared CWE-914
CVE-2026-34444Shared CWE-914

Affected Assets

Sap
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Access enforcement directly stops unauthorized reads/writes to any named resource, including dynamically identified variables.

SI-10 Information Input Validation partial match

Input validation on variable identifiers stops malformed or unauthorized dynamic names from being used.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent dynamic variable control flaws via coding standards, reviews, and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect and prevent dynamic-variable weaknesses before release.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle requires input validation and variable handling rules that reduce dynamic-variable misuse.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate strict control over dynamically-identified variables.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles discourage unsafe dynamic variable access patterns.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly prohibit uncontrolled dynamic variable access.

References