CVE‑2020‑4006: VMware Multiple Products Command‑Injection Vulnerability Allows Privileged OS Execution
What It Is — VMware Workspace ONE Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command‑injection flaw. An attacker who can reach the administrative configurator on TCP 8443 and possesses a valid configurator‑admin password can execute arbitrary OS commands with unrestricted privileges.
Exploitability — Network‑reachable on port 8443; requires valid privileged credentials. No public exploit code released, but the CVSS v3.1 base score is 9.8 (Critical).
Affected Products — VMware Workspace ONE Access, Access Connector, Identity Manager, Identity Manager Connector (all versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient protection for privileged accounts – a core control‑area for identity and access management.
- Highlights the need for continuous monitoring and immutable logging of privileged actions to provide defensible audit evidence.
- Shows that network segmentation and strict access‑control policies are essential to meet the “protect” function of NIST CSF 2.0 and to satisfy multiple downstream compliance regimes.
Recommended Actions
- Apply VMware’s security patch for CVE‑2020‑4006 immediately.
- Rotate all configurator‑admin passwords and enforce multi‑factor authentication for privileged accounts.
- Restrict network access to the configurator (port 8443) to trusted management subnets only; use firewall rules or zero‑trust segmentation.
- Enable detailed logging of all privileged sessions and command execution; forward logs to a centralized SIEM for continuous monitoring.
- Conduct a rapid privileged‑access review to verify that no other default credentials exist.
Source: CISA KEV – CVE‑2020‑4006