CVE-2020-4241: IBM Spectrum Scale and Spectrum Protect Plus OS Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 and high EPSS percentile indicate significant risk, though exploitation requires authentication and no KEV listing or public exploit is confirmed.

What it is

IBM Spectrum Scale and IBM Spectrum Protect Plus versions 10.1.0 through 10.1.5 contain an OS command injection flaw (CWE-78). A remote authenticated attacker can send a specially crafted request to execute arbitrary commands on the system. The vulnerability is high severity with a CVSS 3.1 score of 8.8.

Impact

An attacker who can authenticate can execute arbitrary commands on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability. This could allow data theft, system takeover, or disruption of backup and storage operations.

Attack surface

The flaw is reachable over the network (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) but no user interaction (UI:N). An attacker must have valid credentials to send the crafted request.

Exploitation

The vulnerability is not listed in CISA KEV, but EPSS indicates a high probability of exploitation (0.66298, 99.24th percentile). No public exploit or ransomware usage is documented in the record.

What to do

• Apply the vendor patch referenced in IBM support page node/6114130.
• Restrict network access to affected IBM Spectrum Scale and Spectrum Protect Plus interfaces to trusted users only.
• Enforce strong authentication and least privilege for accounts that can access the affected services.
• Monitor for unusual command execution or process creation on systems running the affected products.
• If patching is not immediately possible, consider isolating affected systems from untrusted networks.

Detection

• Monitor application and system logs for unexpected command execution or child processes spawned by IBM Spectrum services.
• Use endpoint detection to alert on suspicious process creation (e.g., cmd.exe, /bin/sh) originating from IBM Spectrum Scale or Spectrum Protect Plus processes.
• Review authentication logs for anomalous or brute-force attempts against the affected services.
• Inspect network traffic for crafted requests targeting the vulnerable endpoints, if signatures are available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.