CVE-2020-37193
Published: 11 February 2026
Summary
CVE-2020-37193 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Top Password (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 1.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37193 is a denial of service vulnerability affecting ZIP Password Recovery version 2.30. The flaw, linked to CWE-120 (buffer copy without checking size of input), enables attackers to crash the application through maliciously crafted input. Specifically, a specially prepared text file containing certain characters triggers the crash when a user selects a ZIP file within the software.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network-accessible exploitation with low complexity, no privileges, and no user interaction required from the attacker. Any remote attacker can create and deliver the crafted text file, causing the targeted application to crash and deny service to the user running ZIP Password Recovery 2.30.
Advisories and references, including those from VulnCheck (https://www.vulncheck.com/advisories/zip-password-recovery-zip-file-denial-of-service) and a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/47894), document the issue and provide reproduction details. The vendor site (https://www.top-password.com/purchase.html) is referenced, but no patches or specific mitigations are detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31138
Vulnerability details
ZIP Password Recovery 2.30 contains a denial of service vulnerability that allows attackers to crash the application by providing maliciously crafted input. Attackers can create a specially prepared text file with specific characters to trigger an application crash when selecting…
more
a ZIP file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client application directly enables application crash via crafted input, matching Application or System Exploitation for DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of input size and format before processing the crafted text/ZIP file, directly blocking the unchecked buffer copy (CWE-120) that crashes the application.
Applies memory protections (e.g., ASLR, DEP, bounds checking) that mitigate exploitation of the buffer overflow and resulting denial-of-service crash.
Limits the effects of the crafted-input denial-of-service attack on the ZIP Password Recovery process, preserving availability for legitimate users.