CVE-2020-4428: IBM Data Risk Manager OS command injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.1, confirmed KEV exploitation, and very high EPSS make this an urgent patch-first item despite the authentication requirement.

What it is

IBM Data Risk Manager versions 2.0.1 through 2.0.4 contain an OS command injection flaw (CWE-78) that lets a remote authenticated attacker run arbitrary commands on the host. Because the commands execute with the application's privileges and the CVSS scope is changed, a compromise can extend beyond the vulnerable component. It is listed in CISA's Known Exploited Vulnerabilities catalog, so it is a confirmed target in the wild.

Impact

An attacker with valid credentials gains arbitrary command execution on the Data Risk Manager server, which can lead to full host compromise and lateral movement into connected systems. The changed-scope rating means impact is not confined to the application itself.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N), but it requires authenticated access with high privileges (PR:H). The flaw is in the product's command handling, so any exposed Data Risk Manager interface is a candidate entry point.

Exploitation

CISA added it to the KEV catalog on 2021-11-03 with a remediation due date of 2022-05-03, indicating known exploitation; EPSS is very high at roughly 0.617 (99th percentile). No ransomware campaign use is recorded, and no public exploit reference is tagged in the supplied data.

What to do

• Apply the vendor patch from IBM support document 6206875; this is the primary fix.
• If patching is not immediately possible, restrict network access to Data Risk Manager to trusted management networks only.
• Enforce least privilege and review accounts with high privileges on the product, since exploitation requires authenticated high-privilege access.
• Monitor IBM advisories and the KEV entry for updated guidance and confirm the installed version is 2.0.4 or later as patched.

Detection

• Alert on unexpected child processes spawned by the Data Risk Manager application or its web server user.
• Monitor application and system logs for command-injection patterns such as shell metacharacters in request parameters.
• Baseline normal outbound connections from the Data Risk Manager host and alert on new or unusual destinations.
• Audit authentication logs for high-privilege account activity preceding process creation events on the server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.