CVE-2020-37196
Published: 11 February 2026
Summary
CVE-2020-37196 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Domain Name Search Software. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.
NVD Description
Dnss Domain Name Search Software contains a denial of service vulnerability that allows attackers to crash the application by providing an oversized registration key. Attackers can generate a 1000-character buffer payload and paste it into the registration key field to…
more
trigger an application crash.
Deeper analysisAI
CVE-2020-37196 is a denial-of-service vulnerability affecting Dnss Domain Name Search Software. The issue arises from a buffer overflow condition (CWE-120) triggered by providing an oversized registration key, such as a 1000-character payload pasted into the registration key field, which causes the application to crash. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high impact on availability with no effects on confidentiality or integrity.
Remote attackers can exploit this vulnerability over the network without privileges, authentication, or user interaction by simply entering the oversized payload into the registration key field. Successful exploitation results in a denial of service, crashing the application and disrupting its functionality.
Advisories and related resources include a VulnCheck advisory at https://www.vulncheck.com/advisories/dnss-domain-name-search-software-key-denial-of-service, a proof-of-concept exploit documented on Exploit-DB at https://www.exploit-db.com/exploits/47856, and the vendor site at http://www.nsauditor.com/. No specific patch or mitigation details are provided in the available information.
Details
- CWE(s)