CVE-2020-37130
Published: 05 February 2026
Summary
CVE-2020-37130 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Nsauditor. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 4.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.
NVD Description
Nsauditor 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can create a malicious payload of 1000 bytes of repeated characters to trigger an application crash when pasted…
more
into the registration name field.
Deeper analysisAI
CVE-2020-37130 is a denial of service vulnerability in Nsauditor 3.2.0.0, specifically affecting the registration name input field. Attackers can trigger an application crash by pasting a malicious payload of 1000 bytes of repeated characters into this field. The flaw is associated with CWE-120 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no confidentiality or integrity effects.
Any unauthenticated attacker (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Exploitation leads to a complete denial of service by crashing the Nsauditor application, disrupting its functionality for the targeted user.
References for this CVE include the vendor site at http://www.nsauditor.com, a proof-of-concept exploit at https://www.exploit-db.com/exploits/48286, and an advisory from VulnCheck at https://www.vulncheck.com/advisories/nsauditor-name-denial-of-service. No specific patch or mitigation details are provided in the available information.
Details
- CWE(s)