CVE-2020-37206
Published: 11 February 2026
Summary
CVE-2020-37206 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Sharealarmpro. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.
NVD Description
ShareAlarmPro contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key. Attackers can generate a 1000-character buffer payload to trigger an application crash when pasted into the registration key field.
Deeper analysisAI
CVE-2020-37206 is a denial-of-service vulnerability in ShareAlarmPro, a network access control application. The flaw stems from a buffer overflow (CWE-120) in the registration key handling, where the application crashes when an oversized input, such as a 1000-character payload, is supplied to the registration key field. This issue received a CVSS v3.1 base score of 7.5, reflecting high severity due to its impact on availability.
Any remote attacker can exploit this vulnerability without authentication, privileges, or user interaction, as it is network-accessible with low attack complexity (AV:N/AC:L/PR:N/UI:N). By pasting the oversized payload into the registration key field, the attacker triggers an application crash, resulting in high availability impact (A:H) with no effects on confidentiality or integrity.
Advisories and related resources, including an exploit demonstration on Exploit-DB (https://www.exploit-db.com/exploits/47859) and a VulnCheck advisory (https://www.vulncheck.com/advisories/sharealarmpro-advanced-network-access-control-key-denial-of-service), detail the issue; the vendor site (http://www.nsauditor.com/) may provide patching guidance.
Details
- CWE(s)