{"id":"CVE-2020-4429","aliases":["EUVD-2020-25676","GHSA-5634-wp84-cm8x"],"status":"published","title":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password...","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.","severity":{"version":"3.0","score":10,"vector":"CVSS:3.0/S:C/AV:N/A:H/AC:L/PR:N/C:H/I:H/UI:N/RC:C/RL:O/E:U","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.71951,"percentile":0.99432,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-798"],"published":"2020-05-07T19:20:19Z","modified":"2026-06-17T03:19:58Z","exploits":[{"source":"metasploit","id":"auxiliary/admin/http/ibm_drm_download","title":"IBM Data Risk Manager Arbitrary File Download","type":"auxiliary","date":"2020-04-21","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/admin/http/ibm_drm_download"},{"source":"metasploit","id":"exploit/linux/http/ibm_drm_rce","title":"IBM Data Risk Manager Unauthenticated Remote Code Execution","type":"exploit","platform":"Linux","date":"2020-04-21","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/ibm_drm_rce"},{"source":"metasploit","id":"exploit/linux/ssh/ibm_drm_a3user","title":"IBM Data Risk Manager a3user Default Password","type":"exploit","platform":"Unix","date":"2020-04-21","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/ssh/ibm_drm_a3user"},{"source":"nuclei","id":"CVE-2020-4429","title":"IBM Data Risk Manager - Hardcoded Credentials","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-4429.yaml"}],"products":[{"vendor":"ibm","product":"data risk manager"},{"vendor":"ibm","product":"data_risk_manager"}],"references":[{"url":"https://www.ibm.com/support/pages/node/6206875","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/180534","tags":["vdb-entry","x_refsource_XF","x_transferred","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/1"},{"url":"http://seclists.org/fulldisclosure/2024/Nov/0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4429"},{"url":"https://github.com/advisories/GHSA-5634-wp84-cm8x"}],"sources":{"cve":[{"id":"CVE-2020-4429","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.","status":"published","published":"2020-05-07T19:20:19.816Z","modified":"2025-11-03T21:44:29.648Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/S:C/AV:N/A:H/AC:L/PR:N/C:H/I:H/UI:N/RC:C/RL:O/E:U","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:35:55.460269Z"}],"euvd":[{"id":"EUVD-2020-25676","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.","status":"published","published":"2020-05-07T19:20:19Z","modified":"2025-11-03T21:44:29Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/S:C/AV:N/A:H/AC:L/PR:N/C:H/I:H/UI:N/RC:C/RL:O/E:U","level":"critical"}],"updated_at":"2026-11-02T19:49:31.7352Z"}],"ghsa":[{"id":"GHSA-5634-wp84-cm8x","title":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password...","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.","status":"published","published":"2022-05-24T17:17:27Z","modified":"2025-11-04T00:31:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:04:28.385807Z"}],"nvd":[{"id":"CVE-2020-4429","description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.","status":"published","published":"2020-05-07T20:15:12.737Z","modified":"2026-06-17T03:19:58.71Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:06:00.784809Z"}]}}