CVE-2020-37209
Published: 11 February 2026
Summary
CVE-2020-37209 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Spotftp. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 13.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.
NVD Description
SpotFTP 3.0.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash.
Deeper analysisAI
CVE-2020-37209 is a denial of service vulnerability affecting SpotFTP version 3.0.0.0, specifically in the registration name input field. The issue stems from CWE-120 (buffer copy without checking size of input), where attackers can crash the application by generating a 1000-character buffer payload and pasting it into the 'Name' field. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and was published on 2026-02-11.
Remote attackers require no privileges or authentication to exploit this vulnerability over the network with low complexity and no user interaction, according to the CVSS vector. Successful exploitation crashes the SpotFTP application, causing a denial of service.
Advisories and proof-of-concept exploits are documented in references including nsauditor.com, an Exploit-DB entry at https://www.exploit-db.com/exploits/47868, and a Vulncheck advisory at https://www.vulncheck.com/advisories/spotftp-ftp-password-recovery-name-denial-of-service. No patch or specific mitigation details are provided in the available information.
Details
- CWE(s)