CVE-2020-36995
Published: 29 January 2026
Summary
CVE-2020-36995 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Apple (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2020-36995 is a denial-of-service vulnerability in Mocha Telnet Lite for iOS version 4.2, stemming from improper handling of user configuration input (CWE-120: Buffer Copy without Checking Size of Input). The flaw allows attackers to crash the application by overwriting the 'User' field with 350 bytes of repeated characters, disrupting normal functionality. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation triggers an application crash, rendering Mocha Telnet Lite inoperable and denying service to the affected user.
Advisories from Vulncheck detail the vulnerability and proof-of-concept exploit, while Exploit-DB hosts a corresponding exploit (ID 48728). The application page on the Apple App Store provides version context but no patch information is specified in available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30914
Vulnerability details
Mocha Telnet Lite for iOS 4.2 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the user configuration input. Attackers can overwrite the 'User' field with 350 bytes of repeated characters to trigger an…
more
application crash and prevent normal functionality.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client app input handling directly enables application crash via crafted network/config data, matching T1499.004 Application or System Exploitation for DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of all user inputs, including the 'User' field configuration, to prevent buffer overflows from oversized inputs like 350 bytes of repeated characters.
SI-11 ensures graceful error handling for invalid inputs, avoiding application crashes from improper buffer copy without size checks.
SC-5 limits the effects of denial-of-service events, such as remote network-triggered application crashes in Mocha Telnet Lite.