CVE-2020-4428
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote...
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
- Record
CVE-2020-4428- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AC:L/AV:N/S:C/A:H/C:H/PR:H/UI:N/I:H/E:U/RL:O/RC:C - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2020-25675
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
- Record
EUVD-2020-25675- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AC:L/AV:N/S:C/A:H/C:H/PR:H/UI:N/I:H/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r3v6-c98w-p4j5
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote...
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
- Record
GHSA-r3v6-c98w-p4j5- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
CISA KEV No score
IBM Data Risk Manager Remote Code Execution Vulnerability
IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�
- Record
CVE-2020-4428- Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
- Record
CVE-2020-4428- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | IBM Data Risk Manager Unauthenticated Remote Code Execution | 2020-04-21 |
| Metasploit | IBM Data Risk Manager a3user Default Password | 2020-04-21 |
| Metasploit | IBM Data Risk Manager Arbitrary File Download | 2020-04-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-4428 is a critical vulnerability (CVSS 9.1) in Ibm Data Risk Manager, published May 7, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 61.7%, the 99th percentile. No source names a fixed version.
References
ibm.com/support/pages/node/6206875
exchange.xforce.ibmcloud.com/vulnerabilities/180533
seclists.org/fulldisclosure/2024/Nov/1
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4428
nvd.nist.gov/vuln/detail/CVE-2020-4428
github.com/advisories/GHSA-r3v6-c98w-p4j5