Critical Authentication Bypass in SAP Solution Manager (CVE‑2020‑6207) Risks SMDAgent Compromise
What It Is — CVE‑2020‑6207 is a missing‑authentication flaw in the User Experience Monitoring component of SAP Solution Manager. The vulnerability allows an unauthenticated attacker to invoke a critical function that can take full control of every SMDAgent linked to the manager.
Exploitability — Public proof‑of‑concept code exists; the CVSS v3.1 base score is 9.8 (Critical), indicating easy exploitation and high impact.
Affected Products — SAP Solution Manager (all versions that include the User Experience Monitoring module).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that authentication controls are enforced for privileged functions.
- Lack of proper access controls erodes audit‑ready evidence of “least‑privilege” enforcement, a core trust signal for enterprise buyers.
- Compromise of SMDAgents can cascade to downstream systems, breaking the defensible evidence chain required for regulatory and framework assessments.
Recommended Actions
- Apply SAP’s security patch for CVE‑2020‑6207 immediately.
- Conduct a focused audit of authentication mechanisms for all critical functions in Solution Manager.
- Enable and review detailed logging of SMDAgent communications to capture any anomalous activity.
- Update internal access‑control policies to require multi‑factor authentication for administrative actions.
- Document remediation steps in your control‑evidence repository to support continuous monitoring.
Source: CISA KEV – CVE‑2020‑6207