CVE-2020-4207: IBM IoT Messagesight

Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days.

IBM Watson IoT Message Gateway 2.0.0.x, 5.0.0.0, 5.0.0.1, and 5.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking when handling a failed HTTP request with specific content in the headers. By sending a specially crafted HTTP request, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service. IBM X-Force ID: 174972.

Affected products

• IBM IoT Messagesight: from 2.0.0.0, before 2.0.0.2 (fixed in 2.0.0.2); version 5.0.0.0 only
• IBM Watson IoT Platform - Message Gateway: version 5.0.0.1 only

Published 2020-01-28. Last modified 2026-06-17.