CVE-2020-37142
SEH Buffer Overflow in 10-Strike Network Inventory Enables RCE
Publication date: 2026-02-05
Last updated on: 2026-02-05
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 10-strike | network_inventory_explorer | 8.54 |
| 10-strike | network_inventory_explorer | 3.12.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2020-37142 is a structured exception handler (SEH) buffer overflow vulnerability in 10-Strike Network Inventory Explorer version 8.54. It occurs when an attacker inputs an excessively long string into the 'Computer' parameter during the 'Add' function, specifically in the 'Computer Card' section. This overflow overwrites SEH records, allowing the attacker to control the program's execution flow."}, {'type': 'paragraph', 'content': "The exploit involves crafting a buffer with 211 'A' characters, followed by specific bytes to overwrite the next SEH (nSEH) and SEH pointers. The SEH pointer is overwritten with the address of a 'pop pop ret' sequence in the sqlite3.dll module, which lacks security protections like ASLR and SafeSEH. This setup enables the attacker to redirect execution to injected shellcode, which can execute arbitrary commands such as launching calc.exe."}] [1, 2]
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary code on the affected system with the privileges of the user running 10-Strike Network Inventory Explorer. By exploiting the SEH buffer overflow, an attacker can run malicious payloads remotely or locally, potentially leading to full system compromise.
- Execution of arbitrary code, including malware installation or system manipulation.
- Potential unauthorized access to sensitive data or system resources.
- Disruption of normal application or system operations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the \'Add\' function in 10-Strike Network Inventory Explorer, specifically by inputting a crafted payload into the \'Computer\' parameter field under the \'Computer Card\' section. A common detection method involves sending an excessively long string (e.g., 211 "A" characters followed by specific bytes to overwrite SEH records) to observe if the application crashes or behaves unexpectedly.'}, {'type': 'paragraph', 'content': "Commands and tools used for detection include Metasploit's msf-pattern_create and msf-pattern_offset to identify the exact offset for SEH overwrite. Additionally, a Python script (such as the provided 'poc.py' from the exploit) can generate a malicious payload which is then pasted into the vulnerable input field to test for the overflow."}, {'type': 'list_item', 'content': 'Use msf-pattern_create to generate a unique pattern to identify the overflow offset.'}, {'type': 'list_item', 'content': 'Use msf-pattern_offset to find the exact offset where SEH overwrite occurs (211 bytes).'}, {'type': 'list_item', 'content': "Run the provided Python PoC script to generate a malicious payload (poc.txt), copy its content to clipboard, and paste it into the 'Computer' field in the 'Add' function."}, {'type': 'list_item', 'content': 'Monitor the application for crashes or debugger breakpoints (e.g., pressing SHIFT+F9) to verify SEH overwrite and control.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of the vulnerable 'Add' function in 10-Strike Network Inventory Explorer until a patch or update is available. Restrict access to the application to trusted users only and monitor for suspicious activity that may indicate exploitation attempts.
Additionally, applying security best practices such as running the application with the least privileges necessary and using application whitelisting can reduce the risk of exploitation.
Since the vulnerability involves buffer overflow via crafted input, input validation and sanitization should be implemented by the vendor in future updates.