CVE-2020-37142
Published: 05 February 2026
Summary
CVE-2020-37142 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in 10 Strike (inferred from references). Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 25.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37142 is a structured exception handler buffer overflow vulnerability affecting 10-Strike Network Inventory Explorer version 8.54. The flaw enables attackers to execute arbitrary code by overwriting SEH records using a crafted malicious payload targeting the 'Computer' parameter during the 'Add' function.
The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited by local attackers requiring low complexity, no privileges, and no user interaction. Successful exploitation allows arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability.
Advisories and references provide further details on exploitation and mitigation, including a technical analysis at https://web.archive.org/web/20210105222137/https://whitecr0wz.github.io/posts/Strike-Network-Inventory-Explorer-Structered-Exception-Handling-Overwrite/, the vendor site at https://www.10-strike.com/, a proof-of-concept exploit at https://www.exploit-db.com/exploits/48253, and a VulnCheck advisory at https://www.vulncheck.com/advisories/strike-network-inventory-explorer-add-local-buffer-overflow-seh. Security practitioners should review these sources for patch information and remediation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31036
Vulnerability details
10-Strike Network Inventory Explorer 8.54 contains a structured exception handler buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting SEH records. Attackers can craft a malicious payload targeting the 'Computer' parameter during the 'Add' function to trigger…
more
remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local SEH buffer overflow enabling arbitrary code execution in a client application directly maps to Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly eliminates the buffer overflow vulnerability by requiring timely patching or removal of the vulnerable 10-Strike Network Inventory Explorer version 8.54.
Implements memory protections like DEP and ASLR to block arbitrary code execution from SEH record overwrites in buffer overflow exploits.
Enforces validation of the 'Computer' parameter input to reject malicious payloads that trigger the structured exception handler buffer overflow.