Nsauditor
CVE-2020-37119
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8. Desktop application vulnerability requiring user interaction (crafted DNS lookup). PoC available. |
| Exploit ScenarioDerived | Attacker provides malicious DNS name for lookup via social engineering or imported configuration, triggering code execution in the context of the Nsauditor process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Stack-based buffer overflow in Nsauditor Network Auditing Tool 3.0.28 and 3.2.1.0 in the DNS Lookup tool allows attackers to execute arbitrary code via crafted input. PoC available.
Earlier versions of this analysis (1)
Buffer overflow in Nsauditor DNS Lookup functionality.
RemediationAI
Update Nsauditor to a patched version. Validate input length in DNS lookup fields.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-121 stack overflow in Nsauditor's DNS Lookup tool. Oversized input to the DNS query field overwrites the stack frame, enabling control of the instruction pointer.
Know when Nsauditor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vulnerability in the DNS Lookup tool that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious DNS query payload to trigger a three-byte overwrite, bypass ASLR, and execute shellcode through a carefully constructed exploit.
Executive ViewAI
Nsauditor versions 3.0.28 and 3.2.1.0 contain a critical remote code execution vulnerability with a 9.8 CVSS score that allows attackers to execute arbitrary code through the DNS Lookup tool. Organizations running affected versions face immediate risk of system compromise, data theft, and lateral network movement if the application is internet-facing or accessible to untrusted users.
Disable the DNS Lookup feature in Nsauditor if business operations permit. Implement strict network access controls using firewall rules to limit Nsauditor access to trusted internal networks only. Deploy Web Application Firewalls (WAF) or IDS/IPS signatures to detect DNS Lookup buffer overflow attempts. Isolate affected systems on a segmented network with egress filtering. Implement application whitelisting to prevent arbitrary code execution. Monitor process execution and network connections from Nsauditor for anomalous activity. If Nsauditor can be replaced, discontinue use immediately.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attacker
Nsauditor 3.0.28.0 contains a structured exception handling buffer overflow vulnerability that allows local attackers to
Nsauditor versions up to 3.2.2.0 is affected by allocation of resources without limits or throttling (CVSS 7.5).
SpotFTP Password Recover 2.4.2 contains a denial of service vulnerability that allows local attackers to crash the appli
BlueAuditor 1.7.2.0 contains a buffer overflow vulnerability in the registration key field that allows local attackers t
SpotAuditor 3.6.7 contains a local buffer overflow vulnerability in the Base64 Password Decoder component that allows at
Backup Key Recovery 2.2.4 contains a denial of service vulnerability that allows local attackers to crash the applicatio
NSauditor 3.1.2.0 contains a buffer overflow vulnerability in the SNMP Auditor Community field that allows local attacke
DNSS Domain Name Search Software 2.1.8 contains a buffer overflow vulnerability in the registration code input field tha
SpotPaltalk 1.1.5 contains a denial of service vulnerability in the registration code input field that allows local atta
Nsauditor 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers
Nsauditor 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to
GitHub PoC