CVE-2020-37095
Published: 07 February 2026
Summary
CVE-2020-37095 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Informer (inferred from references). Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37095 is a buffer overflow vulnerability (CWE-121) affecting the Cyberoam Authentication Client version 2.1.2.7. The flaw enables remote attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) memory. It is triggered via a specially crafted malicious input in the 'Cyberoam Server Address' field, earning a critical CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows attackers to gain system-level access by triggering a bind TCP shell on port 1337.
References include an Exploit-DB entry at https://www.exploit-db.com/exploits/48148 detailing a public exploit, a Vulncheck advisory at https://www.vulncheck.com/advisories/cyberoam-authentication-client-buffer-overflow-seh, and software information at https://cyberoam-general-authentication-client.software.informer.com/2.1/. No specific patches or mitigations are detailed in the provided description or references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31099
Vulnerability details
Cyberoam Authentication Client 2.1.2.7 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) memory. Attackers can craft a malicious input in the 'Cyberoam Server Address' field to trigger a bind…
more
TCP shell on port 1337 with system-level access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client software enables remote code execution without authentication or user interaction, directly facilitating Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflow exploitation by validating malicious inputs in the 'Cyberoam Server Address' field.
Implements memory safeguards like DEP and ASLR to protect against SEH overwrite attacks leading to arbitrary code execution.
Ensures timely patching and remediation of the buffer overflow flaw in Cyberoam Authentication Client version 2.1.2.7.