CVE-2020-37191
Published: 11 February 2026
Summary
CVE-2020-37191 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Top Password Software Dialup (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 10.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2020-37191 is a denial of service vulnerability in Top Password Software Dialup Password Recovery version 1.30. The flaw, classified under CWE-120 (Buffer Copy without Checking Size of Input), allows attackers to crash the application by submitting a large 5000-character payload into the User Name and Registration Code input fields, leading to a buffer overflow.
The vulnerability can be exploited remotely by unauthenticated attackers with no privileges required and low complexity, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Successful exploitation results in application denial of service through crashing, with potential confidentiality impacts based on the score metrics.
Advisories and related resources include a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/47907), the vendor site (https://www.top-password.com/), and a detailed advisory from VulnCheck (https://www.vulncheck.com/advisories/top-password-software-dialup-password-recovery-denial-of-service), though specific patch or mitigation guidance is not detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31144
Vulnerability details
Top Password Software Dialup Password Recovery 1.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing input fields. Attackers can trigger the vulnerability by inserting a large 5000-character payload into the User Name and…
more
Registration Code input fields.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client application directly enables T1499.004 (Application or System Exploitation) to crash the process and achieve DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflow exploitation by validating the size and format of large payloads in User Name and Registration Code input fields.
Protects against denial-of-service attacks by limiting the effects of oversized input payloads that crash the vulnerable application.
Remediates the specific CWE-120 buffer overflow flaw in Top Password Software Dialup Password Recovery 1.30 through timely patching or replacement.