CVE-2020-37210
Published: 11 February 2026
Summary
CVE-2020-37210 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Spotie. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37210 is a denial of service vulnerability in SpotIE 2.9.5, stemming from a buffer overflow (CWE-120) in the registration key input field. Attackers can trigger an application crash by generating and pasting a 1000-character buffer payload into the 'Key' field. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high impact on availability with no effects on confidentiality or integrity.
Any unauthenticated attacker can exploit this vulnerability remotely with low attack complexity and no privileges or user interaction required. Exploitation involves submitting the oversized payload to the affected input field, resulting in a complete denial of service through application termination.
Advisories and related resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/spotie-key-denial-of-service, provide further details on the issue. A proof-of-concept exploit is available at https://www.exploit-db.com/exploits/47855, and additional information appears at http://www.nsauditor.com/. No patches are mentioned in the available details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31143
Vulnerability details
SpotIE 2.9.5 contains a denial of service vulnerability in the registration key input that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Key' field to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in input field directly enables application crash for DoS via T1499.004 Application or System Exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents buffer overflow DoS by enforcing validation of registration key inputs to reject oversized or malformed payloads.
SI-9 mitigates the vulnerability by restricting the length and type of inputs to the registration key field, blocking 1000-character payloads.
SI-2 requires timely remediation of the identified buffer overflow flaw in SpotIE through patching or code correction.