{"id":"CVE-2020-4006","kind":"vulnerability","aliases":["CVE-2020-4006"],"related":[],"title":"VMware Multiple Products: Multiple VMware Products Command Injection Vulnerability","description":"VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Command injection in the administrative configurator (port 8443) of VMware Workspace One Access, Identity Manager and their connectors, plus Cloud Foundation and vRealize Suite Lifecycle Manager when they deploy vIDM. An attacker with network access to 8443 and the configurator admin password can run commands as root on the OS. Reported by the NSA. VMware rates it Important (CVSS 7.2) because the password is needed, but CISA lists it as exploited.","severity":"critical","cvss":9.1,"epss":0.17302,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"VMware Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"VMware Workspace One Access","fixed":["KB81754"],"affected":"20.01, 20.10 (Linux)","ecosystem":"vendor"},{"name":"VMware Identity Manager","fixed":["KB81754"],"affected":"3.3.1, 3.3.2, 3.3.3 (Linux)","ecosystem":"vendor"},{"name":"VMware Identity Manager Connector","fixed":["KB81754"],"affected":"19.03.0.0, 19.03.0.1, 3.3.1, 3.3.2, 3.3.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","identity-manager","self-hosted","vendor","vidm","vmware","workspace-one-access"],"not_affected_if":["managed-hosting","no-configurator-exposure"],"how_to_check":"Check whether your Workspace One Access or vIDM appliance is on an affected version: Access 20.01 or 20.10 (Linux); vIDM 3.3.1, 3.3.2 or 3.3.3 (Linux); vIDM Connector 19.03.0.0, 19.03.0.1, 3.3.1, 3.3.2 or 3.3.3 (Linux or Windows). Cloud Foundation 4.x and vRealize Suite LifecycleManager 8.x are affected through their embedded vIDM. Then check whether port 8443 (the configurator) is reachable from untrusted networks, and whether KB81754 has been applied. Access Connector 20.01 and 20.10 on Windows is unaffected.","fix":"Apply the KB81754 patch (https://kb.vmware.com/s/article/81754). The vendor gives no new version numbers. If you cannot patch yet, apply the KB81731 workaround. Block access to port 8443 from untrusted networks, and rotate the configurator admin password.","status":"open","published_at":"2020-11-23T22:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:36+00:00","updated_at":"2026-10-23T20:51:46+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:29:36Z","model":"claude-haiku-5-5","output":{"fix":"Apply the VMware updates per vendor instructions (CISA required action); specific fixed versions are unknown from these sources.","summary":"VMware Workspace One Access, Access Connector, Identity Manager and Identity Manager Connector have a command injection flaw in the administrative configurator on port 8443. An attacker who has network access and the configurator administrator password can run arbitrary commands as root on the underlying OS.","category":"vendor","who_cares":["vmware","workspace-one-access","identity-manager","self-hosted"],"confidence":0.7,"analyst_note":"Get fixed version numbers and the VMware advisory (VMSA for CVE-2020-4006) from the NVD page and the CISA KEV entry; confirm whether the configurator on 8443 is reachable from untrusted networks.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-configurator-exposure"],"severity_if_unknown":"critical"},"cost_usd":0.000384,"input_tokens":2150,"output_tokens":337,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Get fixed version numbers and the VMware advisory (VMSA for CVE-2020-4006) from the NVD page and the CISA KEV entry; confirm whether the configurator on 8443 is reachable from untrusted networks.","search":"'-2020':11A,14A '-4006':12A,15A '7.2':103B '8443':51B,80B,143C 'access':22A,43B,56B,78B,118C,119C,136C 'account':152C 'action':166C 'admin':84B 'administr':48B,139C,151C 'appli':167C 'attack':75B,133C 'cisa':110B,164C 'cloud':63B 'command':7A,44B,88B,129C,155C 'configur':49B,83B,140C,150C 'connector':29A,61B,120C,126C 'contain':127C 'cve':10A,13A 'cvss':102B 'deploy':72B 'execut':154C 'exploit':30B,114B 'foundat':64B 'host':36B 'ident':32B,57B,121C,124C 'identity':24A,27A 'identity-manag':31B 'import':101B 'inject':8A,45B,130C 'instruct':171C 'lifecycl':68B 'list':111B 'manag':33B,58B,69B,122C,125C 'manager':25A,28A 'multipl':2A,4A 'multiple':17A 'need':108B 'network':77B,135C 'nsa':97B 'one':21A,42B,55B,117C 'oper':162C 'os':93B 'password':85B,106B,147C 'per':169C 'plus':62B 'port':50B,142C 'privileg':158C 'product':3A,6A 'products':18A 'rate':99B 'report':94B 'requir':165C 'root':90B 'run':87B 'self':35B 'self-host':34B 'suit':67B 'system':163C 'under':161C 'unrestrict':157C 'updat':168C 'valid':146C 'vendor':37B,170C 'vidm':38B,73B 'vmware':1A,5A,16A,19A,23A,26A,39B,53B,98B,115C 'vrealiz':66B 'vulner':9A,131C 'workspac':41B,54B,116C 'workspace':20A 'workspace-one-access':40B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-11-23T22:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-4006","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-4006","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T17:39:59+00:00","note":null},{"source":"epss","external_id":"CVE-2020-4006","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-4006","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-4006","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4006","severity":null,"published_at":"2020-11-23T22:15:12+00:00","modified_at":"2026-06-17T03:19:25+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2020-4006:29","url":null,"severity":null,"published_at":"2026-10-23T20:51:46+00:00","modified_at":"2026-10-23T20:51:46+00:00","first_seen_at":"2026-10-23T20:51:46+00:00","fetched_at":"2026-10-23T20:51:46+00:00","note":"Read VMSA-2020-0027.2 (primary). Fix is the KB81754 patch, not a version number; workaround KB81731. Vendor severity Important 7.2 (requires configurator admin password); exploited per CISA KEV. PoC link not checked."}],"documents":[{"id":875,"url":"https://www.vmware.com/security/advisories/VMSA-2020-0027.html","title":"VMSA-2020-0027.2 (VMware/Broadcom)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}