CVE-2020-4207

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-28 · updated 2026-06-17
Weakness: CWE-120

Description

IBM Watson IoT Message Gateway 2.0.0.x, 5.0.0.0, 5.0.0.1, and 5.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking when handling a failed HTTP request with specific content in the headers. By sending a specially crafted HTTP request, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service. IBM X-Force ID: 174972.

Affected products

IBM IoT MessageSight: from 2.0.0.0 before 2.0.0.2; 5.0.0.0 — fixed in 2.0.0.2
IBM Watson Iot Platform - Message Gateway: 5.0.0.1

How to fix

Upgrade to a fixed version: IBM IoT MessageSight 2.0.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-4207 or the next vulnerability affects your stack