CVE-2020-37143
Published: 05 February 2026
Summary
CVE-2020-37143 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Cnet (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 11.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2020-37143 is a denial of service vulnerability in ProficySCADA for iOS version 5.0.25920. The flaw enables attackers to crash the application by overwriting the password input field with 257 bytes of repeated characters, which triggers an application crash and prevents successful authentication. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-770.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges or user interaction. Successful exploitation causes the application to crash, denying service by blocking authentication attempts.
Advisories and related resources include a VulnCheck advisory at https://www.vulncheck.com/advisories/proficyscada-for-ios-password-denial-of-service, a proof-of-concept exploit on Exploit-DB at https://www.exploit-db.com/exploits/48236, and a CNET download page at https://download.cnet.com/proficyscada/3000-2064_4-75728256.html. No specific patch or mitigation details are provided in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31037
Vulnerability details
ProficySCADA for iOS 5.0.25920 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the password input field. Attackers can overwrite the password field with 257 bytes of repeated characters to trigger an application crash…
more
and prevent successful authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to application exploitation causing crash and denial of authentication/service (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates inputs to the password field, rejecting oversized or malformed data like 257 bytes of repeated characters to prevent application crashes.
Implements denial-of-service protections to block or mitigate remote attacks that crash the application via excessive password input.
Ensures error handling in the authentication process gracefully manages buffer overflows or invalid inputs without triggering application crashes.