CVE Intelligence
Analysis AI-assisted

CVE-2020-37075: LanSend Buffer Overflow in Add Computers Wizard File Import

CVE-2020-37075 is a buffer overflow in the file import feature of the Add Computers Wizard in LanSend 3.2, which the CNA describes as allowing remote attackers to execute arbitrary code. The CNA rates it critical, with a CVSS 3.1 score of 9.8 and CWE-120 assigned. The sources consulted do not list affected or fixed versions, and the CVE is not in the CISA KEV catalog.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2020-37075 is a buffer overflow in the file import feature of the Add Computers Wizard in LanSend 3.2. According to the record's description, a crafted file can lead to arbitrary code execution. The listed CNA is disclosure@vulncheck.com, and the weakness is classified as CWE-120 (Classic Buffer Overflow).

Impact

  • The record describes remote code execution by an attacker who supplies a malicious file.
  • The CVSS 3.1 vector in the record marks confidentiality, integrity and availability impact as high, and requires no privileges or user interaction.
  • The CNA also provides a CVSS 4.0 score of 8.4 alongside the 3.1 score of 9.8.

Affected products and versions

  • The record names LanSend 3.2 in its description.
  • The structured affected-products list is empty, so the full range of affected versions is unknown.
  • No fixed version is listed in the record. This does not confirm that no fix exists.

Exploitation status

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted. The record references an Exploit-DB entry; its content was not reviewed for this analysis.

Remediation and mitigation

  • Check the vendor page for an updated release and confirm whether a fixed build exists.
  • If no fix is available, consider removing or replacing the software on systems that process untrusted input.
  • Restrict who can import computer lists and accept files only from trusted sources.
  • Limit network exposure of hosts running the application and apply least privilege to its service account.

Detection guidance

  • Watch for unexpected crashes or restarts of LanSend, which can indicate failures in handling malformed input.
  • Monitor for unusual child processes launched by the application.
  • Review logs and file transfer records for imports of computer lists from unfamiliar sources.

Limitations of the available information

  • Affected and fixed versions are not provided in the structured data.
  • No EPSS or SSVC data is present in the record.
  • The record has no title, so the title used here is derived from the description.
  • Only the CNA's CVSS scores are available; no independent scoring was checked.

Frequently asked questions

Is CVE-2020-37075 being actively exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which LanSend version is affected?

The description names LanSend 3.2. The structured affected-products list is empty, so the full range of affected versions is unknown.

Is a fixed version available?

The record lists no fixed version. Check the vendor page for an updated release before deciding on next steps.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.