CVE-2020-37136

MediumPublic PoC

Published: 05 February 2026

Published

05 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 6.7 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0003 8.3th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-37136 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Emtec (inferred from references). Its CVSS base score is 6.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 8.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2020-37136 is a denial-of-service vulnerability affecting ZOC Terminal version 7.25.5, stemming from CWE-121 (stack-based buffer overflow). The issue resides in the private key file input field, where attackers can supply a 2000-byte buffer that overwrites the field. This causes the application to crash or become unresponsive when users attempt to create SSH key files. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its impact on availability.

Remote attackers can exploit this vulnerability without authentication, privileges, or user interaction, as it is accessible over the network with low complexity. By providing the oversized buffer input, an attacker can reliably crash the ZOC Terminal application, rendering it unusable for affected users and disrupting SSH-related operations.

Advisories and additional details are available from the vendor at https://www.emtec.com, a proof-of-concept exploit at https://www.exploit-db.com/exploits/48292, and a dedicated advisory at https://www.vulncheck.com/advisories/zoc-terminal-private-key-file-denial-of-service, which may provide further guidance on mitigations or patches.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2020-31035

Vulnerability details

ZOC Terminal 7.25.5 contains a denial of service vulnerability in the private key file input field that allows attackers to crash the application. Attackers can overwrite the private key file input with a 2000-byte buffer, causing the application to become…

unresponsive when attempting to create SSH key files.

CWE(s): CWE-121

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Buffer overflow in SSH client app input field directly enables application crash via exploitation, matching Endpoint DoS (Application or System Exploitation).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1