DNS
CVE-2020-37095
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8 with PoC. Cyberoam auth clients run on corporate desktops for network authentication. |
| Exploit ScenarioDerived | An attacker sends crafted packets to the Cyberoam client, overflowing the stack and gaining code execution on the corporate desktop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Cyberoam Authentication Client 2.1.2.7 has a buffer overflow allowing remote attackers to execute code through the network authentication service.
Earlier versions of this analysis (1)
Buffer overflow in Cyberoam Authentication Client enables remote code execution.
RemediationAI
Update the client software.
Affected ProductsAI
Cyberoam Authentication Client 2.1.2.7
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cyberoam Authentication Client 2.1.2.7 has a CWE-121 stack buffer overflow in its network communication handler.
Know when DNS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Cyberoam Authentication Client 2.1.2.7 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) memory. Attackers can craft a malicious input in the 'Cyberoam Server Address' field to trigger a bind TCP shell on port 1337 with system-level access.
Executive ViewAI
Cyberoam Authentication Client 2.1.2.7 contains a critical remote code execution vulnerability (CVSS 9.8) that allows unauthenticated attackers to gain complete system control. Any organization running this authentication client is at immediate risk of compromise, with active exploits already in the wild and no vendor patch currently available.
Implement network segmentation to restrict client-to-server communication to trusted networks only; deploy WAF rules to block malformed requests targeting authentication services; disable Cyberoam Authentication Client if alternative authentication method exists; enforce strict firewall rules limiting access to authentication service ports; monitor for suspicious process execution and SEH overwrite attempts; consider air-gapping or VPN-tunneling affected systems until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security g
Buffer overflow in Ayukov NFTP client 1.71 in SYST command handling allows remote FTP servers to execute arbitrary code
Buffer overflow in Prime95 29.8 build 6 user ID field allows code execution. PoC available.
Stack overflow in Domain Quester Pro 6.02 via SEH overwrite. PoC available.
Kingdia CD Extractor 3.0.2 has a buffer overflow in the registration name field. PoC available.
Ether MP3 CD Burner 1.3.8 has buffer overflow in registration enabling bind shell on port 3110 via SEH overwrite. PoC av
Buffer overflow in WMV to AVI MPEG DVD Convertor 4.6.1217 allows code execution via crafted media files. PoC available.
Stack-based buffer overflow in Nsauditor Network Auditing Tool 3.0.28 and 3.2.1.0 in the DNS Lookup tool allows attacker
Stack-based buffer overflow in Tenda RX3 firmware 16.03.13.11 allows authenticated remote attackers to achieve full syst
Remote code execution in Tenda F453 1.0.0.3 DNS firmware via a buffer overflow in the /goform/SetIpBind endpoint allows
AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by
Remote code execution in Tenda A21 1.0.0.0 firmware results from a stack buffer overflow in the SetIpMacBind function ac
GitHub PoC