CVE-2020-4428

Timeline

Detection, updates, and resolution for this record.

1. May 7, 2020 · Catalog

   Detected

   IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 3, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.

Affected

• cpe ibm/data risk managerversion unspecified
• vendor IBM Data Risk Managerversion unspecified

Sources

• CISA KEVCVE-2020-4428

  IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�

  cisa.gov
• CVE.orgCVE-2020-4428

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2020-4428

  30-day exploitation probability 61.7%

  first.org
• Metasploit Modulesauxiliary_admin/http/ibm_drm_download

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• Metasploit Modulesexploit_linux/http/ibm_drm_rce

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• Metasploit Modulesexploit_linux/ssh/ibm_drm_a3user

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2020-4428

  IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.

  nvd.nist.gov

References

• Mailing List · seclists.org
• Mailing List · seclists.org
• VDB Entry · exchange.xforce.ibmcloud.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Patch · ibm.com