CVE-2020-37067

HighPublic PoCDDoS

Published: 03 February 2026

Published

03 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0037 28.9th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2020-37067 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Utillyty (inferred from references). Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2020-37067 is a denial-of-service vulnerability in the Filetto 1.0 FTP server, specifically affecting the processing of the FEAT command. The issue arises from a buffer overflow triggered by an oversized FEAT command consisting of 11,008 bytes of repeated characters, which causes the FTP service to crash and terminate.

Remote attackers with network access to the FTP server can exploit this vulnerability without authentication or user interaction, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation results in a denial of service by terminating the service, with CWE-770 (Allocation of Resources Without Limits or Throttling) as the underlying weakness.

Advisories and references, including those from VulnCheck and an Exploit-DB entry (exploit 48503), document the vulnerability and provide a proof-of-concept exploit. The Filetto project page on SourceForge and the vendor site at utillyty.eu are also referenced, though no specific patches or mitigations are detailed in the available information.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2020-30998

Vulnerability details

Filetto 1.0 FTP server contains a denial of service vulnerability in the FEAT command processing that allows attackers to crash the service. Attackers can send an oversized FEAT command with 11,008 bytes of repeated characters to trigger a buffer overflow…

and terminate the FTP service.

CWE(s): CWE-770

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Unauthenticated remote buffer overflow in public-facing FTP server directly enables T1190 exploitation and T1499.004 application DoS via crafted FEAT command.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0