CVE-2020-37207
Published: 11 February 2026
Summary
CVE-2020-37207 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Spotdialup. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37207 is a denial of service vulnerability in SpotDialup version 1.6.7, stemming from a buffer overflow (CWE-120) in the registration key input field. Attackers can trigger an application crash by generating and pasting a 1000-character buffer payload into the "Key" field. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high impact on availability with network accessibility and low attack complexity.
Remote attackers require no privileges or user interaction to exploit this issue, enabling them to crash the SpotDialup application and cause a denial of service. The attack involves simply inputting the oversized payload into the vulnerable field while the application is running.
Advisories and proof-of-concept details are documented in references including an Exploit-DB entry (https://www.exploit-db.com/exploits/47872), a VulnCheck advisory (https://www.vulncheck.com/advisories/spotdialup-key-denial-of-service), and NSAuditor (http://www.nsauditor.com/). No patches or specific mitigations are detailed in the CVE information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31181
Vulnerability details
SpotDialup 1.6.7 contains a denial of service vulnerability in the registration key input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Key' field to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in registration key field enables remote unauthenticated crash of the application, directly matching application/system exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the registration key input field to reject oversized payloads that trigger the buffer overflow.
Enforces memory protections that can block exploitation of the buffer overflow even if input validation fails.
Requires timely remediation of the identified buffer-overflow flaw in SpotDialup before attackers can supply the malicious key.