CVE-2020-37211
Published: 11 February 2026
Summary
CVE-2020-37211 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Spotim. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 14.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.
NVD Description
SpotIM 2.2 contains a denial of service vulnerability that allows attackers to crash the application by inputting a large buffer in the registration name field. Attackers can generate a 1000-character payload and paste it into the 'Name' field to trigger…
more
an application crash.
Deeper analysisAI
CVE-2020-37211 is a denial-of-service vulnerability in SpotIM version 2.2, stemming from a buffer overflow condition (CWE-120) in the registration name field. Attackers can crash the application by submitting a large buffer, such as a 1000-character payload, into the 'Name' field during registration. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for high availability impact without compromising confidentiality or integrity.
Any remote attacker can exploit this vulnerability over the network with low attack complexity, no required privileges, and no user interaction. Successful exploitation results in an application crash, denying service to legitimate users of the affected SpotIM instance.
Advisories and proof-of-concept exploits are documented in references such as NSAuditor, Exploit-DB (exploit 47870), and VulnCheck, which detail the denial-of-service triggered by oversized input in the SpotIM name field. No specific patch or mitigation details are outlined in the provided CVE information.
Details
- CWE(s)