CVE-2020-37209
Published: 11 February 2026
Summary
CVE-2020-37209 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Spotftp. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 14.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).
Deeper analysis
CVE-2020-37209 is a denial of service vulnerability affecting SpotFTP version 3.0.0.0, specifically in the registration name input field. The issue stems from CWE-120 (buffer copy without checking size of input), where attackers can crash the application by generating a 1000-character buffer payload and pasting it into the 'Name' field. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and was published on 2026-02-11.
Remote attackers require no privileges or authentication to exploit this vulnerability over the network with low complexity and no user interaction, according to the CVSS vector. Successful exploitation crashes the SpotFTP application, causing a denial of service.
Advisories and proof-of-concept exploits are documented in references including nsauditor.com, an Exploit-DB entry at https://www.exploit-db.com/exploits/47868, and a Vulncheck advisory at https://www.vulncheck.com/advisories/spotftp-ftp-password-recovery-name-denial-of-service. No patch or specific mitigation details are provided in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31141
Vulnerability details
SpotFTP 3.0.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in application input field directly enables remote DoS via application exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflow crashes by requiring validation of input size and content in fields like the registration name.
Enforces input restrictions such as maximum length limits to block oversized payloads like the 1000-character buffer from crashing the application.
Ensures graceful error handling for invalid inputs to mitigate application crashes from unhandled buffer overflows.