CVE-2020-37138
Published: 05 February 2026
Summary
CVE-2020-37138 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in 10 Strike (inferred from references). Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 45.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37138 is a stack-based buffer overflow vulnerability (CWE-121) affecting 10-Strike Network Inventory Explorer version 9.03, specifically in its file import functionality. The flaw enables remote attackers to execute arbitrary code by crafting a malicious text file with a carefully constructed payload that triggers the overflow and bypasses data execution prevention via a ROP chain.
Remote unauthenticated attackers can exploit this vulnerability over the network (AV:N/AC:L/PR:N/UI:N/S:U), requiring no privileges or user interaction. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), earning a CVSS v3.1 base score of 9.8.
Advisories and references, including a detailed analysis from VulnCheck and a public proof-of-concept exploit on Exploit-DB (ID 48264), are available alongside vendor pages at 10-strike.com and the product site at 10-strike.com/networkinventoryexplorer/. The vulnerability was published on 2026-02-05.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31027
Vulnerability details
10-Strike Network Inventory Explorer 9.03 contains a buffer overflow vulnerability in the file import functionality that allows remote attackers to execute arbitrary code. Attackers can craft a malicious text file with carefully constructed payload to trigger a stack-based buffer overflow…
more
and bypass data execution prevention through a ROP chain.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client-side file import directly enables client-side RCE via crafted malicious file (T1203 + T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely patching or upgrading of 10-Strike Network Inventory Explorer to remediate the specific stack-based buffer overflow in file import functionality.
SI-10 enforces validation of imported text files to prevent oversized or malformed payloads from triggering the buffer overflow.
SI-16 provides memory safeguards like ASLR and stack canaries to hinder arbitrary code execution from the stack-based buffer overflow, despite ROP chain bypass of DEP.