CVE-2020-37074: Remote Desktop Audit Buffer Overflow in Add Computers Wizard (SEH Bypass)
CVE-2020-37074 is a buffer overflow in Remote Desktop Audit 2.3.0.157 that the record links to the Add Computers Wizard file import process. According to the record, a crafted file can bypass structured exception handling (SEH) and lead to arbitrary code execution. The record reports a CVSS 3.1 score of 9.8 from VulnCheck, but CISA KEV does not list it and no confirmed exploitation appears in the sources consulted.
Overview
According to the CVE record, Remote Desktop Audit 2.3.0.157 contains a buffer overflow in the file import routine of its Add Computers Wizard. The record describes a structured exception handler (SEH) bypass that can lead to execution of shellcode when a crafted computer list file is imported.
Impact
The record states that an attacker can execute arbitrary code. The CVSS 3.1 vector in the record describes a network-reachable attack with low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. Whether this is reachable in a given deployment depends on who can supply import files; that is an inference.
Affected products and versions
- The record names Remote Desktop Audit version 2.3.0.157.
- The record contains no structured list of affected or fixed versions, so the affected range beyond that named version is unknown.
- The vendor page linked in the references may provide product version details.
Exploitation status
- CISA KEV does not list this CVE in the record, so active exploitation is not confirmed by that source.
- No confirmed exploitation appears in the sources consulted.
- The record lists an Exploit-DB entry among its references, which suggests public exploit material may exist. This analysis does not describe or reproduce it.
Remediation and mitigation
- The record lists no fixed version. The absence of fix data does not mean no fix exists, so check the vendor for an updated release.
- Until a verified fix is installed, limit who can run the tool and who can supply computer list import files.
- Restrict network exposure of systems running the software and run it with least privilege.
- Import computer lists only from trusted and verified sources.
Detection guidance
- Monitor for unexpected crashes or abnormal termination of the application during import operations.
- Review the origin of import files and any available application logs related to the Add Computers Wizard.
- Watch for unexpected child processes started by the application, as a high-level indicator of code execution.
Limitations of the available information
- The record provides no affected or fixed version range beyond the version named in the description.
- The CVSS 3.1 score of 9.8 and the CVSS 4.0 score of 8.4 are both attributed to VulnCheck; no other scoring provider appears in the record.
- EPSS and SSVC data are not available in the record.
- The record's source status is Deferred, and the vendor advisory details are not included beyond the linked references.
Frequently asked questions
Is CVE-2020-37074 being actively exploited?
CISA KEV does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The record does reference an Exploit-DB entry, which suggests public exploit material may exist.
Which versions are affected?
The record names Remote Desktop Audit 2.3.0.157. It does not provide a structured list of affected or fixed versions, so the wider affected range is unknown.
What should administrators do now?
Check the vendor for an updated release, restrict who can run the tool and supply import files, limit network exposure, and import computer lists only from trusted sources.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.