CVE-2020-37187
Published: 11 February 2026
Summary
CVE-2020-37187 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsauditor (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2020-37187 is a denial of service vulnerability in SpotDialup version 1.6.7, specifically within the registration name input field. The flaw allows attackers to crash the application by pasting a 1000-character buffer payload into the 'Name' field. It stems from CWE-120 (Buffer Copy without Checking Size of Input) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation involves generating and submitting the oversized buffer payload to the affected input field, resulting in a high-impact denial of service that crashes the SpotDialup application and disrupts its availability.
References include an NSAuditor page, an Exploit-DB entry (47904) with a proof-of-concept exploit, and a VulnCheck advisory detailing the SpotDialup name denial of service. No patches or specific mitigations are mentioned in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31134
Vulnerability details
SpotDialup 1.6.7 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in input field directly enables application DoS via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of input length and format on the registration Name field to block the oversized buffer that triggers the CWE-120 crash.
Applies memory protections (e.g., ASLR, DEP, stack canaries) that can prevent successful exploitation of the unchecked buffer copy even if oversized input is received.
Limits the effects of the availability impact by restricting resource consumption or isolating the affected application component when the malicious 1000-character payload is processed.