CVE-2020-6207
KEVCRITICAL 9.8EPSS 98.1%
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
- Affected
- SAP SE · SAP Solution Manager (User Experience Monitoring)
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.0 SAP
- 10.0 CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 98.13% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03
- Nuclei
- critical · CWE-306
- Published
- 2020-03-10
- Updated
- 2025-10-21
Proof-of-concept exploits (3)
- http://packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-Remote-Command-Execu…
- http://packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthenticated-Remote-Code-Exe…
- chipik/SAP_EEM_CVE-2020-620782★ · 2021-01-15
Nuclei templates (1)
Metasploit modules (2)
- rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/cve_2020_6207_solman_…
- rapid7/metasploit-framework/blob/master/modules/exploits/multi/sap/cve_2020_6207_solman_r…
Exploit collections (1)
- SAP_EEM_CVE-2020-6207 PoC.mdtzwlhack/Vulnerability
Security advisories
- https://launchpad.support.sap.com/#/notes/2890213
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
- http://packetstormsecurity.com/files/163168/SAP-Solution-Manager-7.20-Missing-Authorizati…
- http://seclists.org/fulldisclosure/2021/Apr/4
- http://seclists.org/fulldisclosure/2021/Jun/34