Cyber Resilience

CVE-2020-37208

MediumPublic PoC

Published: 11 February 2026

Published
11 February 2026
Modified
20 February 2026
KEV Added
Patch
CVSS Score v4 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0002 4.4th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-37208 is a medium-severity Out-of-bounds Write (CWE-787) vulnerability in Nsasoft Spotftp. Its CVSS base score is 4.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 4.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2020-37208 is a buffer overflow vulnerability (CWE-787) affecting SpotFTP version 3.0.0.0 in the registration key input field. Published on 2026-02-11, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high-impact availability disruption with no confidentiality or integrity effects.

The vulnerability can be exploited by remote attackers requiring no privileges or user interaction. By generating a 1000-character payload and pasting it into the 'Key' field, attackers trigger an application crash, resulting in a denial of service.

Advisories from VulnCheck and a proof-of-concept on Exploit-DB detail the issue in SpotFTP's FTP password recovery key handling, confirming the crash via the described payload. No patches or vendor-specific mitigations are referenced.

EU & UK References

Vulnerability details

SpotFTP 3.0.0.0 contains a buffer overflow vulnerability in the registration key input field that allows attackers to crash the application. Attackers can generate a 1000-character payload and paste it into the 'Key' field to trigger an application crash and denial…

more

of service.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer overflow in input field directly enables application crash for DoS via exploitation (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2020-37209Same product: Nsasoft Spotftp
CVE-2020-37205Same vendor: Nsasoft
CVE-2019-25340Same vendor: Nsasoft
CVE-2021-47815Same vendor: Nsasoft
CVE-2020-37204Same vendor: Nsasoft
CVE-2020-37211Same vendor: Nsasoft
CVE-2020-37199Same vendor: Nsasoft
CVE-2020-37130Same vendor: Nsasoft
CVE-2020-37206Same vendor: Nsasoft
CVE-2018-25213Same vendor: Nsasoft

Affected Assets

nsasoft
spotftp
3.0.0.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly validates registration key inputs to block oversized payloads that trigger the buffer overflow and application crash.

prevent

Implements memory protections like stack canaries and DEP to prevent buffer overflows in the registration key field from disrupting system availability.

prevent

Establishes processes to identify, report, and remediate the specific buffer overflow flaw in SpotFTP version 3.0.0.0.

References