CVE-2020-37208
Buffer Overflow in SpotFTP 3.0.0.0 Causes Application Crash
Publication date: 2026-02-11
Last updated on: 2026-02-20
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nsasoft | spotftp | 3.0.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2020-37208 is a buffer overflow vulnerability in SpotFTP FTP Password Recovery version 3.0.0.0 and earlier. It occurs in the registration key input field, where an attacker can input a specially crafted payload of about 1000 characters.
This crafted input causes the application to crash by overflowing the buffer, leading to a denial of service (DoS) condition.
The attack requires local access, low complexity, no privileges, and user interaction to trigger the crash.
How can this vulnerability impact me? :
This vulnerability can cause the SpotFTP application to crash when a maliciously crafted registration key is entered.
The impact is a denial of service (DoS), meaning legitimate users will be unable to use the application while it is crashed.
There is no impact on confidentiality or integrity of data, only availability is affected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by attempting to reproduce the denial of service condition locally on the system running SpotFTP 3.0.0.0. Specifically, an attacker or tester can generate a payload of approximately 1000 characters and input it into the 'Key' registration field of the application."}, {'type': 'paragraph', 'content': "A practical detection method involves creating a file with 1000 'A' characters and pasting this payload into the registration key field to see if the application crashes."}, {'type': 'paragraph', 'content': 'For example, on a Windows system, you can create the payload using a simple Python command:'}, {'type': 'list_item', 'content': 'python -c "print(\'A\'*1000)" > poc.txt'}, {'type': 'paragraph', 'content': "Then open the file, copy the content, and paste it into the 'Key' field of SpotFTP. If the application crashes, the vulnerability is present."}] [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting local access to the SpotFTP application to trusted users only, since the attack requires local access and user interaction.
Avoid pasting or entering untrusted or suspiciously long registration keys into the application.
If possible, monitor and limit user interactions with the registration key input field to prevent exploitation.
Additionally, consider running SpotFTP in a controlled environment or sandbox to minimize impact if a crash occurs.
Since no official patch or update information is provided, contacting the vendor or checking for updates regularly is recommended.