Cyber Resilience

CVE-2020-37194

MediumPublic PoC

Published: 11 February 2026

Published
11 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0004 13.1th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-37194 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsauditor (inferred from references). Its CVSS base score is 4.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2020-37194 is a denial-of-service vulnerability in Backup Key Recovery 2.2.5, stemming from CWE-120 (buffer copy without checking size of input). The issue allows attackers to crash the application by supplying an overly long registration key, such as a 1000-character payload pasted into the registration key field. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting high availability impact with no confidentiality or integrity effects.

Attackers can exploit this remotely over the network with low attack complexity, no privileges required, and no user interaction needed beyond the target's interaction with the registration feature. Successful exploitation results in an application crash, denying service to legitimate users of the software.

Advisories and proof-of-concept details are documented in references such as Exploit-DB (exploit 47864) and VulnCheck, with additional information at nsauditor.com. No patches or specific mitigations are detailed in the available description.

EU & UK References

Vulnerability details

Backup Key Recovery 2.2.5 contains a denial of service vulnerability that allows attackers to crash the application by supplying an overly long registration key. Attackers can generate a 1000-character payload file and paste it into the registration key field to…

more

trigger an application crash.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer overflow in registration key input directly enables application crash for DoS via exploitation (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-20115Shared CWE-120
CVE-2020-37205Shared CWE-120
CVE-2026-28875Shared CWE-120
CVE-2020-37180Shared CWE-120
CVE-2024-24419Shared CWE-120
CVE-2019-25353Shared CWE-120
CVE-2026-30075Shared CWE-120
CVE-2020-37213Shared CWE-120
CVE-2021-47798Shared CWE-120
CVE-2020-37215Shared CWE-120

Affected Assets

Nsauditor
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly prevents the buffer overflow DoS by requiring validation of registration key inputs to reject overly long payloads before processing.

prevent

Enforces limits on the quantity of input in the registration key field, blocking 1000-character payloads that trigger the application crash.

preventdetect

Protects against denial-of-service vulnerabilities like this buffer overflow crash by limiting effects of oversized input attacks and identifying such events.

References