CVE-2020-37196
Published: 11 February 2026
Summary
CVE-2020-37196 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Domain Name Search Software. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2020-37196 is a denial-of-service vulnerability affecting Dnss Domain Name Search Software. The issue arises from a buffer overflow condition (CWE-120) triggered by providing an oversized registration key, such as a 1000-character payload pasted into the registration key field, which causes the application to crash. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high impact on availability with no effects on confidentiality or integrity.
Remote attackers can exploit this vulnerability over the network without privileges, authentication, or user interaction by simply entering the oversized payload into the registration key field. Successful exploitation results in a denial of service, crashing the application and disrupting its functionality.
Advisories and related resources include a VulnCheck advisory at https://www.vulncheck.com/advisories/dnss-domain-name-search-software-key-denial-of-service, a proof-of-concept exploit documented on Exploit-DB at https://www.exploit-db.com/exploits/47856, and the vendor site at http://www.nsauditor.com/. No specific patch or mitigation details are provided in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31178
Vulnerability details
Dnss Domain Name Search Software contains a denial of service vulnerability that allows attackers to crash the application by providing an oversized registration key. Attackers can generate a 1000-character buffer payload and paste it into the registration key field to…
more
trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client application directly enables application-layer DoS via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs (including the registration key field) to reject oversized payloads that trigger the buffer overflow and crash.
Enforces memory protections that can limit the effects of the buffer overflow condition (CWE-120) exploited by the 1000-character registration key.
Requires mechanisms to protect against or limit denial-of-service conditions caused by malformed inputs that crash the application.