Loading vulnerability…
CVE-2020-6287, commonly referred to as RECON, is a critical vulnerability in SAP NetWeaver AS JAVA LM Configuration Wizard affecting versions 7.30, 7.31, 7.40, and 7.50. The flaw is caused by a missing authentication check in the LM Configuration Wizard, allowing a remote attacker with no prior authentication to invoke configuration functionality and perform privileged administrative actions on the SAP Java system. Reported abuse includes the ability to create a new administrative user, which can then be used to take control of the affected platform. The issue is remotely exploitable over the network and has been characterized as maximum severity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository contains a Python proof-of-concept exploit (RECON.py) for the SAP RECON vulnerabilities CVE-2020-6287 and CVE-2020-6286 affecting SAP NetWeaver Application Server Java (LM Configuration Wizard). The exploit leverages missing authentication and a directory traversal flaw in the 'queryProtocol' SOAP method exposed at the /CTCWebService/CTCWebServiceBean endpoint. The script provides several capabilities: (1) checking if a target is vulnerable, (2) downloading arbitrary ZIP files from the server via directory traversal, (3) creating a new SAP Java user with standard privileges, and (4) creating a new SAP Java user with Administrator privileges. The exploit is operational and requires the attacker to specify the target host, port, and desired action via command-line arguments. The main attack vector is network-based, targeting the SOAP web service endpoint over HTTP(S). The repository consists of a single Python exploit script, a README with usage instructions and background, and a .gitignore file.
This repository provides a Python proof-of-concept exploit for CVE-2020-6287, a critical unauthenticated remote code execution vulnerability in SAP NetWeaver. The exploit consists of a single Python script ('sap-CVE-2020-6287-add-user.py') and a README file. The script allows an attacker to create a new user with arbitrary credentials on a vulnerable SAP NetWeaver system by sending a specially crafted SOAP request to the '/CTCWebService/CTCWebServiceBean/ConfigServlet' endpoint. The exploit first checks if the target is vulnerable by accessing the WSDL at '/CTCWebService/CTCWebServiceBean?wsdl'. If the target is vulnerable, it sends a base64-encoded XML payload to create a new user. The exploit does not grant administrator privileges to the new user. The README provides usage instructions and references to the original Metasploit module and research. The attack vector is network-based, requiring only HTTP(S) access to the target system.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously disclosed critical SAP NetWeaver AS Java vulnerability mentioned only in related content.
A historical SAP NetWeaver vulnerability mentioned as background in the vendor security history.
A critical unauthenticated remote code execution vulnerability in SAP NetWeaver AS JAVA that can allow full access to vulnerable systems.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.