CVE-2020-37119
Published: 05 February 2026
Summary
CVE-2020-37119 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Nsasoft Nsauditor. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37119 is a buffer overflow vulnerability in the DNS Lookup tool of Nsauditor versions 3.0.28 and 3.2.1.0. The flaw enables attackers to execute arbitrary code by overwriting memory through a crafted malicious DNS query payload, which triggers a three-byte overwrite. It is associated with CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write), earning a CVSS v3.1 base score of 9.8.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. By constructing a precise payload, they can bypass ASLR and execute shellcode, achieving high impacts on confidentiality, integrity, and availability, potentially leading to full system compromise.
References include a proof-of-concept exploit at https://www.exploit-db.com/exploits/48350, the vendor site at https://www.nsauditor.com/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/nsauditor-buffer-overflow-sehaslr-bypass-bytes-overwrite detailing the SEH ASLR bypass and three-byte overwrite technique. No patch or mitigation details are specified in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31047
Vulnerability details
Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vulnerability in the DNS Lookup tool that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious DNS query payload to trigger a three-byte overwrite, bypass ASLR, and…
more
execute shellcode through a carefully constructed exploit.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated buffer overflow in network-exposed DNS Lookup tool directly enables arbitrary code execution via crafted payload (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly mitigates this buffer overflow by identifying, prioritizing, and applying patches or updates to vulnerable Nsauditor versions.
Information input validation prevents the buffer overflow by ensuring malicious DNS query payloads do not exceed allocated memory bounds.
Memory protection mechanisms like stack canaries, DEP, and safe unlinking block exploitation attempts such as the three-byte SEH overwrite even if invalid input reaches the buffer.