CVE-2020-6207

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

10.0 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

98.27% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03

Nuclei

critical · CWE-306

Published

2020-03-10

Updated

2025-10-21

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-Remote-Command-Execu…
• http://packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthenticated-Remote-Code-Exe…
• chipik/SAP_EEM_CVE-2020-620782★ · 2021-01-15

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6207.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/sap/cve_2020_6207_solman_r…

Exploit collections (1)

• tzwlhack/Vulnerability/blob/main/SAP_EEM_CVE-2020-6207%20PoC.md

References

• CVE Record
• NVD entry

Related

• CVE-2020-6286
• CVE-2020-6287
• CVE-2020-6171
• CVE-2020-6170
• CVE-2020-6168
• CVE-2020-6308