CVE-2020-4006
Multiple VMware Products Command Injection Vulnerability
Description
CVE-2020-4006 is a critical OS command injection vulnerability affecting multiple VMware products, including Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. An attacker with network access to the administrative configurator on port 8443 and a valid administrator password can inject arbitrary operating system commands that execute with unrestricted privileges on the underlying system. This CVE-2020-4006 vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With a CVSS score of 9.1 (CRITICAL) and an EPSS score of 12.83% (93.9th percentile), this command injection flaw poses a significant threat to organizations running affected VMware deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | identity manager | 3.3.1; 3.3.2; 3.3.3 |
| vmware | identity manager connector | 3.3.1; 3.3.2; 3.3.3 |
| vmware | one access | 20.01; 20.10 |
| vmware | cloud foundation | 4.0; 4.0.1 |
| vmware | vrealize suite lifecycle manager | >= 8.0, <= 8.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://www.vmware.com/security/advisories/VMSA-2020-0027.html(Vendor Advisory)
- https://www.kb.cert.org/vuls/id/724367(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4006(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
OS command injection in VMware Workspace One Access and Identity Manager occurs when the administrative configurator fails to properly neutralize special elements in user-supplied input before incorporating it into operating system commands. An authenticated administrator-level attacker can exploit this weakness to inject shell metacharacters and execute arbitrary commands with the same privileges as the vulnerable application, potentially achieving complete system compromise.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
Impact Analysis
CVE-2020-4006 carries a CVSS 3.1 score of 9.1 (CRITICAL), reflecting the severe risk this vulnerability poses. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires high privileges (a valid configurator administrator password). No user interaction is necessary for exploitation, and the scope is changed, meaning successful exploitation can affect resources beyond the vulnerable VMware component itself. Confidentiality (High): an attacker can access sensitive data across the system. Integrity (High): arbitrary command execution allows modification of system files and configurations. Availability (High): the attacker can disrupt services or shut down systems entirely. The EPSS score of 12.83% (93.9th percentile) indicates a high likelihood of active exploitation, placing this vulnerability well above the vast majority of known CVEs in terms of exploitation probability.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-4006 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 12.83% (93.9th percentile) indicates a high probability of ongoing exploitation activity. While no public proof-of-concept exploit was identified in the available references, the confirmed active exploitation and the relatively low barrier for authenticated attackers (requiring only a valid configurator password) make this a high-priority remediation target. Organizations should assume that capable threat actors are actively targeting this vulnerability in VMware identity management infrastructure.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. VMware has released security advisory VMSA-2020-0027 with patches for all affected products.
- Upgrade all affected VMware products to patched versions: Identity Manager 3.3.1/3.3.2/3.3.3, Identity Manager Connector 3.3.1/3.3.2/3.3.3, One Access 20.01/20.10, Cloud Foundation 4.0/4.0.1, and vRealize Suite Lifecycle Manager 8.0–8.2 should all be updated per the vendor advisory.
- Restrict network access to the administrative configurator on port 8443 using firewall rules and network segmentation. Only authorized administrators from trusted network segments should be able to reach this interface.
- Review and rotate all configurator administrator credentials. Implement strong password policies and multi-factor authentication where supported to reduce the risk of credential compromise.
- Monitor system logs for suspicious command execution patterns, unexpected process creation, and unauthorized access to the configurator interface on port 8443. Conduct threat hunting to identify potential prior exploitation.
Technical Details
CVE-2020-4006 exploits an OS command injection weakness (CWE-78) in the administrative configurator component of VMware Workspace One Access, Identity Manager, and related connector products. The configurator, accessible on port 8443, fails to properly sanitize user-supplied input before passing it to operating system shell commands. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that while the attack requires high privileges (a valid configurator admin password), it can be executed remotely with low complexity and no user interaction. The scope change (S:C) is particularly significant, as it means the injected commands can affect the underlying operating system and any other services running on the same host, extending the impact beyond the VMware application itself. The commands execute with unrestricted privileges on the underlying operating system, giving the attacker full control over the compromised host.
Frequently Asked Questions
Is CVE-2020-4006 being actively exploited?
Yes. CVE-2020-4006 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 12.83% (93.9th percentile) further indicates a high probability of exploitation. Federal agencies were required to remediate this vulnerability by 2022-05-03.
What products are affected by CVE-2020-4006?
CVE-2020-4006 affects VMware Identity Manager (versions 3.3.1, 3.3.2, 3.3.3), VMware Identity Manager Connector (versions 3.3.1, 3.3.2, 3.3.3), VMware One Access (versions 20.01, 20.10), VMware Cloud Foundation (versions 4.0, 4.0.1), and VMware vRealize Suite Lifecycle Manager (versions 8.0 through 8.2).
How do I fix CVE-2020-4006?
Apply the patches provided in VMware Security Advisory VMSA-2020-0027 for all affected products. As an interim mitigation, restrict network access to the administrative configurator on port 8443 and rotate administrator credentials. Refer to the Remediation section for detailed steps.
How severe is CVE-2020-4006?
CVE-2020-4006 has a CVSS 3.1 score of 9.1 (CRITICAL). The vulnerability allows authenticated remote command injection with unrestricted system privileges. With an EPSS score in the 93.9th percentile, it ranks among the most likely-to-be-exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.