CVE-2020-37119: Nsasoft Nsauditor DNS Lookup Buffer Overflow

Overview

Nsasoft Nsauditor versions 3.0.28 and 3.2.1.0 contain a buffer overflow in the DNS Lookup tool, classified as CWE-787 (Out-of-bounds Write). The record describes memory overwriting that could allow arbitrary code execution. The published description also mentions techniques for bypassing ASLR; this analysis describes them only at a high level and does not reproduce them.

Vendor information is available on the Nsasoft website. Authoritative record details are in the NVD entry.

Impact

• The record associates the flaw with arbitrary code execution in the context of the affected tool.
• The CNA VulnCheck rates the issue as critical under CVSS 3.1 (9.8), with a network attack vector and no privileges or user interaction required.
• The CVSS 4.0 score in the record is 8.4, which is also high.
• Successful exploitation would affect confidentiality, integrity and availability according to the CVSS 3.1 metrics in the record.

Affected products and versions

• Nsasoft Nsauditor version 3.0.28.
• Nsasoft Nsauditor version 3.2.1.0.

The record does not state whether other versions are affected. Do not assume that versions outside this list are safe without checking with the vendor.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so active exploitation is not confirmed by that source. The references include an Exploit-DB entry tagged as an exploit. That entry shows that public exploit material exists, but it does not confirm exploitation in the wild. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

The record lists no fixed versions. This does not prove that no fix exists. Contact the vendor or check its official channels for an updated release.

• Inventory all systems where Nsauditor is installed, including administrator workstations and shared tools.
• Remove the affected tool or stop using its DNS Lookup function where it is not required.
• Restrict who can run the tool and limit exposure of hosts that run it.
• Apply network segmentation so that the tool cannot easily be used as a stepping point toward sensitive systems.
• Prioritize this asset in vulnerability management given the critical base score.

Detection guidance

• Monitor hosts running Nsauditor for unexpected crashes, restarts or abnormal process behavior in the DNS Lookup function.
• Review application and endpoint logs for unusual execution of the tool or of child processes it spawns.
• Track unusual DNS query patterns originating from hosts running the tool, using existing network monitoring.
• Confirm installed versions through software inventory tools.

Limitations of the available information

• The record does not include a vendor advisory with official fix details.
• The EPSS score and SSVC data are not available in the record, so likelihood-based prioritization is unknown.
• The referenced VulnCheck advisory is marked as a broken link in the record, so its contents were not verified.
• The record does not confirm the full scope of affected products or platforms.

Frequently asked questions

Is CVE-2020-37119 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed in-the-wild exploitation appears in the sources consulted. A public Exploit-DB entry is referenced, which does not by itself confirm exploitation.

Which Nsauditor versions are affected?

The record names versions 3.0.28 and 3.2.1.0. It does not state whether other versions are affected.

Is there a fixed version?

The record lists no fixed version. Check the vendor's official channels for an updated release.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.