CVE-2020-37212
Published: 11 February 2026
Summary
CVE-2020-37212 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsasoft Spotmsn. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2020-37212 is a denial of service vulnerability in SpotMSN version 2.4.6. The flaw occurs in the registration name input field, where attackers can paste a 1000-character payload into the 'Name' field to trigger an application crash. It is associated with CWE-120 (Buffer Copy without Checking Size of Input) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with low complexity and no privileges required.
Unauthenticated attackers with network access can exploit this vulnerability by supplying the oversized payload during the registration process, causing the SpotMSN application to crash and resulting in a denial of service. The attack requires no user interaction beyond the input and has no effects on confidentiality or integrity.
Advisories and references, including those from VulnCheck detailing the SpotMSN name denial of service, an Exploit-DB entry (47869) with a proof-of-concept, and NSAuditor, document the issue but do not specify patches or mitigations in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31171
Vulnerability details
SpotMSN 2.4.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character payload and paste it into the 'Name' field to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client registration input directly enables application-layer DoS via crafted oversized payload (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the size and format of inputs to the registration name field, preventing oversized payloads from triggering the buffer overflow crash.
Implements denial-of-service protections to limit effects of oversized input attacks that crash the application.
Restricts the amount and length of information enterable into the name field by unauthenticated users, blocking 1000-character payloads.