CVE-2020-37075

CriticalPublic PoC

Published: 03 February 2026

Published

03 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0026 49.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-37075 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Lizardsystems (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 49.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the buffer overflow flaw in LanSend 3.2's file import functionality through timely patching.

SI-10 Information Input Validation good match

prevent

Validates imported files in the Add Computers Wizard to block malicious payloads that trigger buffer overflows.

SI-16 Memory Protection good match

prevent

Provides memory protections such as DEP and ASLR to thwart SEH overwrite and shellcode execution from buffer overflows.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

The buffer overflow vulnerability in LanSend's file import functionality directly enables arbitrary code execution via a crafted malicious file, mapping to Exploitation for Client Execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

LanSend 3.2 contains a buffer overflow vulnerability in the Add Computers Wizard file import functionality that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload file to trigger a structured exception handler (SEH) overwrite and execute…

shellcode when importing computers from a file.

Deeper analysisAI

CVE-2020-37075 is a buffer overflow vulnerability (CWE-120) affecting LanSend version 3.2, specifically in the Add Computers Wizard file import functionality. The flaw enables remote attackers to execute arbitrary code by crafting a malicious payload file that triggers a structured exception handler (SEH) overwrite, leading to shellcode execution when the file is imported.

Attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An unauthenticated remote attacker can achieve full remote code execution on the target system running the vulnerable software.

Advisories and related resources, including a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/48461) and a VulnCheck advisory (https://www.vulncheck.com/advisories/lansend-buffer-overflow-seh), detail the issue. The vendor product page is available at https://lizardsystems.com/lansend/.