{"id":"CVE-2020-4428","aliases":["EUVD-2020-25675","GHSA-r3v6-c98w-p4j5"],"status":"published","title":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote...","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.","severity":{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AC:L/AV:N/S:C/A:H/C:H/PR:H/UI:N/I:H/E:U/RL:O/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.61692,"percentile":0.99177,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2020-05-07T19:20:19Z","modified":"2026-06-17T03:19:58Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/ibm_drm_rce","title":"IBM Data Risk Manager Unauthenticated Remote Code Execution","type":"exploit","platform":"Linux","date":"2020-04-21","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/ibm_drm_rce"},{"source":"metasploit","id":"exploit/linux/ssh/ibm_drm_a3user","title":"IBM Data Risk Manager a3user Default Password","type":"exploit","platform":"Unix","date":"2020-04-21","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/ssh/ibm_drm_a3user"},{"source":"metasploit","id":"auxiliary/admin/http/ibm_drm_download","title":"IBM Data Risk Manager Arbitrary File Download","type":"auxiliary","date":"2020-04-21","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/admin/http/ibm_drm_download"}],"products":[{"vendor":"ibm","product":"data risk manager"},{"vendor":"ibm","product":"data_risk_manager"}],"references":[{"url":"https://www.ibm.com/support/pages/node/6206875","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/180533","tags":["vdb-entry","x_refsource_XF","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/0","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4428","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4428"},{"url":"https://github.com/advisories/GHSA-r3v6-c98w-p4j5"}],"sources":{"cve":[{"id":"CVE-2020-4428","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.","status":"published","published":"2020-05-07T19:20:19.315Z","modified":"2025-11-03T21:44:26.545Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AC:L/AV:N/S:C/A:H/C:H/PR:H/UI:N/I:H/E:U/RL:O/RC:C","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:55.797746Z"}],"euvd":[{"id":"EUVD-2020-25675","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.","status":"published","published":"2020-05-07T19:20:19Z","modified":"2025-11-03T21:44:26Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AC:L/AV:N/S:C/A:H/C:H/PR:H/UI:N/I:H/E:U/RL:O/RC:C","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T19:49:31.7352Z"}],"ghsa":[{"id":"GHSA-r3v6-c98w-p4j5","title":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote...","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.","status":"published","published":"2022-05-24T17:17:27Z","modified":"2025-11-04T00:31:32Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:28.385807Z"}],"kev":[{"id":"CVE-2020-4428","title":"IBM Data Risk Manager Remote Code Execution Vulnerability","description":"IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�","cwes":["CWE-78"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2020-4428","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.","status":"published","published":"2020-05-07T20:15:12.673Z","modified":"2026-06-17T03:19:58.553Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:00.784809Z"}]}}