CVE-2020-37207
Published: 11 February 2026
Summary
CVE-2020-37207 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Spotdialup. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.
NVD Description
SpotDialup 1.6.7 contains a denial of service vulnerability in the registration key input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Key' field to trigger an application crash.
Deeper analysisAI
CVE-2020-37207 is a denial of service vulnerability in SpotDialup version 1.6.7, stemming from a buffer overflow (CWE-120) in the registration key input field. Attackers can trigger an application crash by generating and pasting a 1000-character buffer payload into the "Key" field. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high impact on availability with network accessibility and low attack complexity.
Remote attackers require no privileges or user interaction to exploit this issue, enabling them to crash the SpotDialup application and cause a denial of service. The attack involves simply inputting the oversized payload into the vulnerable field while the application is running.
Advisories and proof-of-concept details are documented in references including an Exploit-DB entry (https://www.exploit-db.com/exploits/47872), a VulnCheck advisory (https://www.vulncheck.com/advisories/spotdialup-key-denial-of-service), and NSAuditor (http://www.nsauditor.com/). No patches or specific mitigations are detailed in the CVE information.
Details
- CWE(s)