CVE-2020-4006: Multiple VMware Products Command Injection Vulnerability

CVE-2020-4006 is a command injection vulnerability in several VMware identity and access products: Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. An attacker who can reach the administrative configurator on port 8443 and who already holds a valid configurator administrator password can run operating-system commands with unrestricted privileges. That combination turns a compromised admin credential into full host control, which is why identity-platform teams should treat this as a high-priority fix.

Public detail is limited to the products and access conditions above; exact version ranges, CVSS scores, and patch identifiers must be confirmed against the vendor advisory. CISA’s required action is simply to apply updates per vendor instructions. Ransomware use is not documented for this CVE.

How it works

The weakness is CWE-78 (OS command injection). In products of this class the administrative configurator accepts input that is later passed to a shell or system command without adequate sanitization. Once an attacker authenticates to the configurator interface, they can supply crafted values that cause the application to execute arbitrary commands as a privileged process on the underlying operating system.

Because the configurator is intended for setup and ongoing administration, it typically runs with elevated rights. Successful abuse therefore yields unrestricted OS-level execution rather than a limited application sandbox. No public exploit mechanics beyond the network-access-plus-valid-password precondition are supplied in the given facts; defenders should assume that any authenticated session to port 8443 is sufficient to attempt the injection and should verify the precise attack surface in the vendor advisory.

Am I affected? How to find it in your systems

These components commonly appear in enterprise identity, single-sign-on, and workspace environments—often as virtual appliances or connectors that bridge on-premises directories to cloud services. Inventory steps:

• Search asset and CMDB records for VMware Workspace ONE Access, Access Connector, Identity Manager, and Identity Manager Connector.
• Scan internal networks for listeners on TCP 8443 and correlate those hosts with VMware identity appliances.
• Review appliance or installer version strings against the fixed versions listed in the current VMware security advisory; do not rely on version numbers recalled from memory.
• Confirm whether the administrative configurator remains enabled and reachable from untrusted or broadly accessible network segments.

Telemetry that may indicate abuse includes unexpected processes spawned by the configurator service, shell or command-line activity originating from the appliance’s service accounts, and authentication successes to the configurator followed immediately by anomalous outbound connections or privilege-escalation artifacts. Because the attack requires a valid administrator password, also examine logs for configurator login failures or password-spray patterns preceding suspicious command execution.

How to remediate

Patch first. Apply the updates VMware published for the affected products exactly as described in the vendor advisory. CISA’s guidance is to follow those vendor instructions; no alternative remediation path is supplied in the facts.

After patching, harden the remaining attack surface common to this product class:

• Restrict network access to port 8443 to a small set of jump hosts or management networks.
• Rotate the configurator administrator password and any related service credentials; enforce strong, unique secrets and, where supported, multi-factor authentication.
• Disable or remove the administrative configurator once initial setup is complete if the product permits it.
• Ensure the appliance OS and any supporting packages are also current, reducing the value of a successful command injection.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Segment the appliances so that port 8443 is unreachable from user VLANs, the internet, and most server subnets; allow only explicitly authorized management stations.
• Place a reverse proxy or web-application firewall in front of the configurator and block or tightly validate request patterns that could carry command metacharacters—treating this as virtual patching, not a substitute for the real fix.
• Temporarily disable the configurator interface if operational procedures allow.
• Increase monitoring: alert on any process creation by the configurator service, on new outbound connections from the appliance, and on configurator authentications outside change windows.
• Verify that existing EDR or host-based controls on the appliance (if present) are running and reporting.

These measures shrink the window of opportunity but do not eliminate the underlying injection flaw; schedule the official update as soon as practicable.

If your data may have been exposed

Actively exploited command-injection flaws on identity infrastructure frequently lead to credential theft, lateral movement, and broader breaches. If you have reason to believe the configurator was reached by an unauthorized party, follow your incident-response plan: isolate the host, preserve logs, rotate all secrets that the appliance could have accessed, and examine downstream systems for follow-on activity. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether associated credentials have appeared in prior public dumps.