CVE Intelligence
Analysis AI-assisted

CVE-2020-37095: Cyberoam Authentication Client Stack-Based Buffer Overflow

CVE-2020-37095 is recorded against Cyberoam Authentication Client 2.1.2.7 as a stack-based buffer overflow that can allow remote code execution by overwriting SEH memory. The record gives a CVSS 3.1 base score of 9.8 (critical) from VulnCheck. It shows no CISA KEV listing and no structured affected or fixed version data.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2020-37095 is recorded as a stack-based buffer overflow in Cyberoam Authentication Client 2.1.2.7. The record was published on 2026-02-07, and VulnCheck is the CNA. Beyond the CVSS data supplied by VulnCheck, the record shows no further NVD enrichment details.

Impact

  • The description states that a remote attacker could execute arbitrary code by overwriting SEH memory.
  • The CVSS 3.1 vector describes a network attack with no privileges and no user interaction, and high impact to confidentiality, integrity and availability.
  • The description also says the outcome can include a bind TCP shell with system-level access. This is reported in the record and was not independently verified here.

Affected products and versions

  • The description names Cyberoam Authentication Client 2.1.2.7.
  • The record contains no structured affected version range and no fixed version.

Exploitation status

  • This record does not list the CVE in CISA KEV, so no active exploitation is claimed.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The record references an Exploit-DB entry, which indicates public exploit material is referenced. The EPSS probability is 0.00754 with percentile 0.53877, as recorded.

Remediation and mitigation

  • Inventory systems running Cyberoam Authentication Client, with particular attention to version 2.1.2.7.
  • Check the vendor and the VulnCheck advisory for updates. The sources consulted do not confirm a fixed release.
  • Restrict network reachability of the client and its server-address configuration, and limit exposure of affected hosts.
  • If no vendor fix is available and the product is unsupported, plan removal or replacement.

Detection guidance

  • Watch hosts running the client for unexpected listening ports, including an unrecognized listener on TCP 1337.
  • Review application and system logs for client crashes and unusual child processes.
  • Alert on unexpected inbound connections to hosts running this software.

Limitations of the available information

  • The record does not provide fixed versions, vendor patch status or a complete affected range.
  • The CVSS 4.0 and 3.1 scores come from VulnCheck; no other scoring source appears in the record.
  • The EPSS date of 2026-10-13 is reproduced as recorded and was not cross-checked.

Frequently asked questions

Is CVE-2020-37095 known to be exploited in the wild?

The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted. The record does reference an Exploit-DB entry, so public exploit material is referenced.

Which version is affected?

The description names Cyberoam Authentication Client 2.1.2.7. The record has no structured affected range or fixed version, so other versions cannot be confirmed.

What should defenders do now?

Inventory deployments, check the vendor and advisory sources for updates, restrict network exposure, and monitor for unexpected listeners and connections.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.