CVE-2020-37211
Published: 11 February 2026
Summary
CVE-2020-37211 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Spotim. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2020-37211 is a denial-of-service vulnerability in SpotIM version 2.2, stemming from a buffer overflow condition (CWE-120) in the registration name field. Attackers can crash the application by submitting a large buffer, such as a 1000-character payload, into the 'Name' field during registration. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for high availability impact without compromising confidentiality or integrity.
Any remote attacker can exploit this vulnerability over the network with low attack complexity, no required privileges, and no user interaction. Successful exploitation results in an application crash, denying service to legitimate users of the affected SpotIM instance.
Advisories and proof-of-concept exploits are documented in references such as NSAuditor, Exploit-DB (exploit 47870), and VulnCheck, which detail the denial-of-service triggered by oversized input in the SpotIM name field. No specific patch or mitigation details are outlined in the provided CVE information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31172
Vulnerability details
SpotIM 2.2 contains a denial of service vulnerability that allows attackers to crash the application by inputting a large buffer in the registration name field. Attackers can generate a 1000-character payload and paste it into the 'Name' field to trigger…
more
an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in network-accessible registration field directly enables application crash via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates inputs like the registration name field to reject oversized payloads and prevent buffer overflow crashes.
Provides denial-of-service protections to limit or block effects of remote buffer overflow attacks causing application crashes.
Requires timely identification, reporting, and correction of flaws such as the buffer overflow in SpotIM's registration name field.