CVE-2020-6207
published 2020-03-10CVE-2020-6207: SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service…
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
98.27%
99.9th percentile
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | solution_manager | — | — |
| sap_se | sap_solution_manager | < 7.2 | 7.2 |
Detection & IOCsextracted from sources · hover to see the quote
other:getAllAgentInfoResponse
otherSAP NetWeaver Application Server
snort
alert http any any -> any any (msg:"ET EXPLOIT Suspected SAP EEM SOLMAN RCE (CVE-2020-6207)"; flow:established,to_server; http.uri; content:"/EemAdminService/EemAdmin"; startswith; fast_pattern; http.request_body; content:"getruntime|28 29 2e|exec"; nocase; content:"processbuilder|28|"; nocase; reference:url,github.com/chipik/SAP_EEM_CVE-2020-6207; classtype:attempted-admin; sid:2031546; rev:1; metadata:created_at 2021_01_25, cve CVE_2020_6207, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_01_25;)
bytes
getruntime|28 29 2e|exec
bytes
processbuilder|28|
- →Target endpoint is /EemAdminService/EemAdmin — detect unauthenticated POST/SOAP requests to this URI on the SAP Solution Manager HTTP(S) port as a primary indicator of exploitation attempts. ↗
- →Exploit payloads contain Java Runtime/ProcessBuilder RCE patterns in the SOAP request body — look for 'getruntime().exec' and 'processbuilder(' strings (case-insensitive) in HTTP POST bodies to /EemAdminService/EemAdmin.
- →Successful unauthenticated responses from a vulnerable SAP SolMan instance will contain ':getAllAgentInfoResponse' in the body and 'SAP NetWeaver Application Server' in the response header with HTTP 200 and Content-Type text/xml.
- →Commands on compromised SMDAgents execute as the 'daaadm' service account — look for unexpected OS-level process spawning under this user on SAP satellite systems. ↗
- →The Metasploit module and PoC reference the EEM servlet component internally named 'tc~smd~agent~application~eem' — this string may appear in SAP application logs when the vulnerable component is accessed. ↗
- →Active scanning for this vulnerability has been observed in the wild — monitor for high-frequency unauthenticated SOAP requests to /EemAdminService/EemAdmin from external IPs. ↗
- →The exploit is stable against SMDAgents running Java version 1.8 — Java version fingerprinting of connected agents can help prioritize patching. ↗
- ·Exploitation impact extends beyond the SolMan host itself — all SMDAgents (satellite systems) connected to the Solution Manager are fully compromised upon successful exploitation. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r9hh-cq9h-xf68: SAP Solution Manager (User Experience Monitoring), version- 7
ghsa_unreviewed·2022-05-24
CVE-2020-6207 [CRITICAL] CWE-306 GHSA-r9hh-cq9h-xf68: SAP Solution Manager (User Experience Monitoring), version- 7
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
VulnCheck
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
vulncheck·2020·CVSS 9.8
CVE-2020-6207 [CRITICAL] CWE-306 SAP Solution Manager Missing Authentication for Critical Function Vulnerability
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
Affected: SAP Solution Manager
Required Action: Apply updates per vendor instructions.
Exploitation References: https://digital.nhs.uk/cyber-alerts/2021/cc-3815; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.csoonline.com/article/3674119/most-common-sap-vulnerabilities-attackers-try-to-exploit.html; https://www.csoonline.com/article/2092336/sap-users-are-at-high-risk-as-hackers-exploit-application-vulnerabilities.html; https://go.onapsis.com/threat-repor
CISA
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2020-6207 [CRITICAL] CWE-306 SAP Solution Manager Missing Authentication for Critical Function Vulnerability
Vulnerability: SAP Solution Manager Missing Authentication for Critical Function Vulnerability
Affected: SAP Solution Manager
SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-6207
Remediation Due Date: 2022-05-03
Suricata
ET EXPLOIT Suspected SAP EEM SOLMAN RCE (CVE-2020-6207)
suricata·2021-01-25·CVSS 9.8
CVE-2020-6207 [CRITICAL] ET EXPLOIT Suspected SAP EEM SOLMAN RCE (CVE-2020-6207)
ET EXPLOIT Suspected SAP EEM SOLMAN RCE (CVE-2020-6207)
Rule: alert http any any -> any any (msg:"ET EXPLOIT Suspected SAP EEM SOLMAN RCE (CVE-2020-6207)"; flow:established,to_server; http.uri; content:"/EemAdminService/EemAdmin"; startswith; fast_pattern; http.request_body; content:"getruntime|28 29 2e|exec"; nocase; content:"processbuilder|28|"; nocase; reference:url,github.com/chipik/SAP_EEM_CVE-2020-6207; classtype:attempted-admin; sid:2031546; rev:1; metadata:created_at 2021_01_25, cve CVE_2020_6207, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_01_25;)
Suricata
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2006-6207 [HIGH] ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno ASCII
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno ASCII"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; classtype:web-application-attack; sid:2007064; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Init
Suricata
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6207 [HIGH] ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UNION SELECT
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UNION SELECT"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; classtype:web-application-attack; sid:2007061; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tac
Suricata
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2006-6207 [HIGH] ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno DELETE
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno DELETE"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; classtype:web-application-attack; sid:2007063; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Init
Suricata
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6207 [HIGH] ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno INSERT
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno INSERT"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; classtype:web-application-attack; sid:2007062; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Init
Suricata
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2006-6207 [HIGH] ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UPDATE
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UPDATE"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; classtype:web-application-attack; sid:2007065; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initi
Suricata
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6207 [HIGH] ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno SELECT
ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno SELECT"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; classtype:web-application-attack; sid:2007060; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Init
Metasploit
SAP Solution Manager remote unauthorized OS commands execution
metasploit·CVSS 9.8
CVE-2020-6207 [CRITICAL] SAP Solution Manager remote unauthorized OS commands execution
SAP Solution Manager remote unauthorized OS commands execution
This module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem) of SAP Solution Manager (SolMan) running version 7.2. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information about connected SMDAgents, send HTTP request (SSRF), and execute OS commands on connected SMDAgent. Works stable in connected SMDAgent with Java version 1.8. Successful exploitation of the vulnerability enables unauthenticated remote attackers to achieve SSRF and execute OS commands from the agent connected to SolMan as a user from which the SMDAgent service starts, usually the daaadm.
Metasploit
SAP Solution Manager remote unauthorized OS commands execution
metasploit·CVSS 9.8
CVE-2020-6207 [CRITICAL] SAP Solution Manager remote unauthorized OS commands execution
SAP Solution Manager remote unauthorized OS commands execution
This module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem) of SAP Solution Manager (SolMan) running version 7.2. The vulnerability occurs due to missing authentication checks when submitting a SOAP request to the /EemAdminService/EemAdmin page to get information about connected SMDAgents, send HTTP request (SSRF) and execute OS command on connected SMDAgent. Works stable in connected SMDAgent with Java version 1.8. Successful exploitation will allow unauthenticated remote attackers to get reverse shell from connected to the SolMan agent as the user under which it runs SMDAgent service, usually daaadm.
Nuclei
SAP Solution Manager 7.2 - Remote Command Execution
nuclei·CVSS 9.8
CVE-2020-6207 [CRITICAL] SAP Solution Manager 7.2 - Remote Command Execution
SAP Solution Manager 7.2 - Remote Command Execution
SAP Solution Manager (SolMan) running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem). The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information about connected SMDAgents, send HTTP request (SSRF), and execute OS commands on connected SMDAgent.
Template:
id: CVE-2020-6207
info:
name: SAP Solution Manager 7.2 - Remote Command Execution
author: _generic_human_
severity: critical
description: SAP Solution Manager (SolMan) running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem). The vulnerability occurs due to missing
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Checkpoint
25th January – Threat Intelligence Report
blogs_checkpoint·2021-01-25
CVE-2021-1678 25th January – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 25th January – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 25th January, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
The CHwapi hospital in Belgium has been hit by BitLocker, encrypting 40 of its servers and 100 TB of data. The attack caused the hospital to redirect patients and delay surgical procedures.
Check Point SandBlast Agent provides protection against this threat
Cybersecurity firm SonicWall has suffered an attack on its inte
Tenable
CVE-2020-6207: Proof of Concept Available for Missing Authentication Vulnerability in SAP Solution Manager
blogs_tenable·2021-01-22·CVSS 9.8
[CRITICAL] CVE-2020-6207: Proof of Concept Available for Missing Authentication Vulnerability in SAP Solution Manager
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthenticated-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/163168/SAP-Solution-Manager-7.20-Missing-Authorization.htmlhttp://seclists.org/fulldisclosure/2021/Apr/4http://seclists.org/fulldisclosure/2021/Jun/34https://launchpad.support.sap.com/#/notes/2890213https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305http://packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthenticated-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/163168/SAP-Solution-Manager-7.20-Missing-Authorization.htmlhttp://seclists.org/fulldisclosure/2021/Apr/4http://seclists.org/fulldisclosure/2021/Jun/34https://launchpad.support.sap.com/#/notes/2890213https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6207
2020-03-10
Published
2021-11-03
Added to CISA KEV
Exploited in the wild