SAP Solution Manager - Authentication Bypass (CVE-2020-6207)
Description
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
psychologyCrowdSec Analysis
CVE-2020-6207 is a critical vulnerability in SAP Solution Manager, where missing authentication checks in a specific administrative service can allow remote attackers to compromise all connected agents.
CrowdSec has been tracking this vulnerability and its exploits since 23rd of May 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-6207 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2020-6207 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Observed exploitation attempts are associated with requests to the /eemadminservice/eemadmin endpoint.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2020-03-10 |
| CISA KEV | 2021-11-03 |
| CISA Remediation Deadline | 2022-05-03 |
| Rule Released | 2025-05-23 |
| CrowdSec First Seen | 2025-05-23 |