CVE-2020-37042
Published: 30 January 2026
Summary
CVE-2020-37042 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 8.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37042 is a local buffer overflow vulnerability (CWE-120) affecting Frigate Professional version 3.36.0.9, specifically in the 'Find Computer' feature. The flaw occurs when attackers overflow the computer name input field with a malicious payload, triggering a buffer overflow that enables arbitrary code execution. A proof-of-concept demonstrates this by launching the calculator application.
The vulnerability has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity with local attack vector, low complexity, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Local attackers can exploit it to execute arbitrary code on the affected system, potentially leading to full compromise without authentication.
Advisories and resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/frigate-professional-find-computer-local-buffer-overflow and an Exploit-DB entry at https://www.exploit-db.com/exploits/48579, document the issue and proof-of-concept exploit. The archived Frigate website at https://web.archive.org/web/20190623044943/http://www.frigate3.com/index.php provides additional context on the software.
An exploit is publicly available on Exploit-DB, confirming practical exploitation feasibility for local attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30936
Vulnerability details
Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the 'Find Computer' feature that allows attackers to execute arbitrary code by overflowing the computer name input field. Attackers can craft a malicious payload that triggers a buffer overflow, enabling…
more
code execution and launching calculator as a proof of concept.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local buffer overflow in a client application (Frigate file manager) directly enables arbitrary code execution via exploitation of the vulnerable input field, matching T1203 Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of computer name inputs to prevent buffer overflows from malicious payloads in the 'Find Computer' feature.
Implements memory protections like ASLR and DEP to mitigate arbitrary code execution from buffer overflow exploits.
Mandates timely remediation of the specific buffer overflow flaw in Frigate Professional 3.36.0.9 via patching or upgrades.