Buffer overflow in IBM Aspera Faspex On Demand
Priority LOW 38CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902.
Why it matters now
EPSS 0.03093 87th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Aspera Faspex On Demand | 3.7.4 | — | No fix listed | CNA |
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) | 3.9.10 | — | No fix listed | CNA |
| IBM | Aspera High-Speed Transfer Endpoint | 3.9.3 | — | No fix listed | CNA |
| IBM | Aspera Streaming | 3.9.3 | — | No fix listed | CNA |
| IBM | Aspera Server On Demand | 3.7.4 | — | No fix listed | CNA |
| IBM | Aspera Shares On Demand | 3.7.4 | — | No fix listed | CNA |
| IBM | Aspera Application Platform On Demand | 3.7.4 | — | No fix listed | CNA |
| IBM | Aspera Transfer Cluster Manager | 1.3.1 | — | No fix listed | CNA |
| IBM | Aspera High-Speed Transfer Server | 3.9.3 | — | No fix listed | CNA |
| IBM | Aspera Proxy Server | 1.4.3 | — | No fix listed | CNA |
- Aspera Faspex On Demand VendorIBM Affected 3.7.4 Fixed in — No fix listed CNA
- Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) VendorIBM Affected 3.9.10 Fixed in — No fix listed CNA
- Aspera High-Speed Transfer Endpoint VendorIBM Affected 3.9.3 Fixed in — No fix listed CNA
- Aspera Streaming VendorIBM Affected 3.9.3 Fixed in — No fix listed CNA
- Aspera Server On Demand VendorIBM Affected 3.7.4 Fixed in — No fix listed CNA
- Aspera Shares On Demand VendorIBM Affected 3.7.4 Fixed in — No fix listed CNA
- Aspera Application Platform On Demand VendorIBM Affected 3.7.4 Fixed in — No fix listed CNA
- Aspera Transfer Cluster Manager VendorIBM Affected 1.3.1 Fixed in — No fix listed CNA
- Aspera High-Speed Transfer Server VendorIBM Affected 3.9.3 Fixed in — No fix listed CNA
- Aspera Proxy Server VendorIBM Affected 1.4.3 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:aspera_application_platform_on_demand:*:*:*:*:*:*:*:* | up to 3.7.4 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_faspex_on_demand:*:*:*:*:*:*:*:* | up to 3.7.4 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:*:*:*:*:*:*:*:* | up to 3.9.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_high-speed_transfer_server:*:*:*:*:*:*:*:* | up to 3.9.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_high-speed_transfer_server_for_cloud_pak_for_integration:*:*:*:*:*:*:*:* | up to 3.9.10 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_proxy_server:*:*:*:*:*:*:*:* | up to 1.4.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_server_on_demand:*:*:*:*:*:*:*:* | up to 3.7.4 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_shares_on_demand:*:*:*:*:*:*:*:* | up to 3.7.4 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_streaming:*:*:*:*:*:*:*:* | up to 3.9.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_transfer_cluster_manager:*:*:*:*:*:*:*:* | up to 1.3.1 | Vulnerable | IBM |
- cpe:2.3:a:ibm:aspera_application_platform_on_demand:*:*:*:*:*:*:*:* Versions up to 3.7.4 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_faspex_on_demand:*:*:*:*:*:*:*:* Versions up to 3.7.4 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:*:*:*:*:*:*:*:* Versions up to 3.9.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_high-speed_transfer_server:*:*:*:*:*:*:*:* Versions up to 3.9.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_high-speed_transfer_server_for_cloud_pak_for_integration:*:*:*:*:*:*:*:* Versions up to 3.9.10 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_proxy_server:*:*:*:*:*:*:*:* Versions up to 1.4.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_server_on_demand:*:*:*:*:*:*:*:* Versions up to 3.7.4 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_shares_on_demand:*:*:*:*:*:*:*:* Versions up to 3.7.4 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_streaming:*:*:*:*:*:*:*:* Versions up to 3.9.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_transfer_cluster_manager:*:*:*:*:*:*:*:* Versions up to 1.3.1 Vulnerable ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-4436
- 2026-10-03 Alias added: GHSA-9vrg-pr26-w94g
References
More IBM Aspera Application Platform On Demand vulnerabilities
- TI-2020-03800 Improper input validation in IBM Aspera Faspex On Demand CVSS 3.1HIGH 7.5
- TI-2020-03799 Command injection in IBM Aspera Streaming CVSS 3.1HIGH 7.5
- TI-2020-03801 Buffer overflow in IBM Aspera Shares On Demand CVSS 3.1HIGH 7.5
- TI-2020-03802 Out-of-bounds write in IBM Aspera Transfer Cluster Manager CVSS 3.1HIGH 7.5
Sources
- CVE-2020-4436 · CVE Program
- CVE-2020-4436 · NVD
- FIRST EPSS
- GHSA-9vrg-pr26-w94g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences