CVE Intelligence
Analysis AI-assisted

CVE-2020-37010: BearShare Lite 5.2.5 Advanced Search Buffer Overflow

CVE-2020-37010 describes a classic buffer overflow (CWE-120) in the Advanced Search keywords input of BearShare Lite 5.2.5, which the record says can lead to arbitrary code execution. The CNA assigned a CVSS 3.1 base score of 9.8 (critical), but the record lists no affected version range or fixed version. CISA KEV does not list this CVE, and the sources consulted show no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes a buffer overflow (CWE-120) in the Advanced Search keywords input of BearShare Lite 5.2.5, as reported by the CNA VulnCheck. The description states that the flaw can allow arbitrary code execution.

Impact

According to the record, successful exploitation could allow arbitrary code execution. The CVSS 3.1 base score of 9.8 reflects network reachability, no privileges or user interaction required, and high confidentiality, integrity and availability impact as assessed by the CNA.

Affected products and versions

  • Product named in the record: BearShare Lite 5.2.5.
  • The record's affected list is empty, so the full range of affected versions is unknown.
  • No fixed version is listed. The absence of a listed fix does not confirm that no fix exists.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The record references an Exploit-DB entry and a VulnCheck advisory. Their presence indicates public technical material exists, but it does not confirm that attacks occurred.

Remediation and mitigation

  • Inventory all systems with BearShare Lite installed, especially version 5.2.5, and confirm whether the software is still needed.
  • Because no vendor fix is identified in the record, consider removing or disabling the application where it is not essential.
  • Restrict who can run the software on sensitive systems and apply general hardening such as least privilege and application allowlisting.
  • Check the vendor and the listed sources for any updated status.

Detection guidance

  • Monitor for unexpected child processes launched by the BearShare application.
  • Review endpoint telemetry for unusual executable activity from user-writable locations shortly after the application is used.

Limitations of the available information

  • The record lacks affected version ranges, fixed versions, vendor advisory text, EPSS and SSVC data.
  • The CVSS 3.1 and 4.0 scores come from the CNA, and no independent scoring is shown.
  • The referenced exploit material was not analysed here and is not reproduced.

Frequently asked questions

Is CVE-2020-37010 listed in the CISA KEV catalog?

No. The record shows the KEV entry as not listed, and the sources consulted show no confirmed exploitation in the wild.

Which versions of BearShare Lite are affected?

The record names BearShare Lite 5.2.5, but its affected list is empty, so the full range of affected versions is unknown.

Is there a fixed version available?

The record lists no fixed version. Check the vendor website and the referenced advisories for current information.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.