Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2020-37119 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Nsasoft Nsauditor. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2020-37119 is a buffer overflow vulnerability in the DNS Lookup tool of Nsauditor versions 3.0.28 and 3.2.1.0. The flaw enables attackers to execute arbitrary code by overwriting memory through a crafted malicious DNS query payload, which triggers a three-byte overwrite. It is associated with CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write), earning a CVSS v3.1 base score of 9.8.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. By constructing a precise payload, they can bypass ASLR and execute shellcode, achieving high impacts on confidentiality, integrity, and availability, potentially leading to full system compromise.
References include a proof-of-concept exploit at https://www.exploit-db.com/exploits/48350, the vendor site at https://www.nsauditor.com/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/nsauditor-buffer-overflow-sehaslr-bypass-bytes-overwrite detailing the SEH ASLR bypass and three-byte overwrite technique. No patch or mitigation details are specified in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31047
Vulnerability Data
Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vulnerability in the DNS Lookup tool that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious DNS query payload to trigger a three-byte overwrite, bypass ASLR, and…
more
execute shellcode through a carefully constructed exploit.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated buffer overflow in network-exposed DNS Lookup tool directly enables arbitrary code execution via crafted payload (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly mitigates this buffer overflow by identifying, prioritizing, and applying patches or updates to vulnerable Nsauditor versions.
Information input validation prevents the buffer overflow by ensuring malicious DNS query payloads do not exceed allocated memory bounds.
Memory protection mechanisms like stack canaries, DEP, and safe unlinking block exploitation attempts such as the three-byte SEH overwrite even if invalid input reaches the buffer.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices directly prevent introduction of stack buffer overflows.
Vulnerability scanning can discover stack buffer overflows but does not prevent their introduction.
Patching eliminates known instances of the weakness after discovery.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing (fuzzing, static analysis) detects stack overflows before release.
Secure SDLC mandates buffer-safety practices that directly prevent stack overflows.
Application security requirements can specify buffer-size and input-validation rules.
Secure architecture principles include memory-safety and least-privilege stack usage.
Secure coding standards explicitly forbid unsafe buffer handling that causes CWE-121.
Change management can enforce review gates that catch unsafe memory operations before deployment.