CVE-2020-4429: IBM Data Risk Manager default admin password enables remote root code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote access to a default administrative credential leading to root code execution is a maximum-severity exposure, and EPSS indicates high exploitation likelihood.

What it is

IBM Data Risk Manager versions 2.0.1 through 2.0.6 ship with a default password for an IDRM administrative account. Because the credential is hard-coded and unauthenticated network access is possible, anyone who can reach the login interface can take over the administrative account. The flaw is rated CVSS 3.1 9.8 (critical) and maps to CWE-798 hard-coded credentials.

Impact

An attacker who logs in with the default administrative password can execute arbitrary code on the underlying system with root privileges, giving full control of the host and any data it manages.

Attack surface

Reachable over the network via the IDRM administrative login; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required. The record does not specify the exact port or endpoint.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.71363, 99.4th percentile), indicating elevated likelihood of exploitation. Reference tags include only a VDB entry and a vendor patch advisory, so no public exploit code is confirmed by the record.

What to do

• Apply the IBM vendor patch referenced in the support advisory (node/6206875) as the first action.
• Change the default IDRM administrative password immediately on any instance that cannot yet be patched.
• Restrict network access to the IDRM administrative interface to trusted management networks only.
• Audit IDRM accounts for default or shared credentials and enforce unique strong passwords.
• If IDRM is no longer supported, migrate off the affected versions or isolate the appliance.

Detection

• Monitor IDRM authentication logs for successful logins to administrative accounts from unexpected source IPs or at unusual times.
• Alert on use of the known default administrative credential against the IDRM login endpoint.
• Watch for post-login process creation or command execution on the IDRM host, especially child processes of the application running as root.
• Review network logs for external or untrusted hosts reaching the IDRM management interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.