CVE-2020-6207

CVE-2020-6207 is a missing authentication check (CWE-306) in the User Experience Monitoring service of SAP Solution Manager 7.2, allowing an unauthenticated remote attacker to interact with the service over the network. The flaw is triggered simply by connecting to the unauthenticated service, and CVSS v3.1 scores it 9.8 Critical with network vector, low complexity, and no privileges or user interaction required. A successful attacker achieves remote command execution on the Solution Manager host and complete compromise of every SMDAgent connected to it, with public reporting noting the exploit yields root-level access. Any organization running SAP Solution Manager 7.2 — deployed across the majority of large SAP enterprise landscapes — is affected, particularly where the monitoring service is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2021-11-03), a fully functional public exploit exists, scanning activity against SAP systems has been reported, and EPSS assigns a 98.3% probability of exploitation within 30 days (100th percentile).

What to do: Apply SAP's patch for this vulnerability (SAP Security Note 2914509) per vendor instructions, as required by the CISA KEV catalog, and ensure all connected SMDAgents are updated with the Solution Manager. Until patched, restrict or block external access to the Solution Manager monitoring service from untrusted networks, since active scanning of SAP systems has been observed. Check whether your instance exposes the affected service to the internet and hunt for signs of compromise on the SolMan host and connected SMDAgents.