CVE Intelligence
Analysis AI-assisted

CVE-2020-37138: 10-Strike Network Inventory Explorer: stack buffer overflow in file import

CVE-2020-37138 is a stack-based buffer overflow (CWE-121) in the file import feature of 10-Strike Network Inventory Explorer 9.03, which the record says can allow remote code execution. The CVSS 3.1 base score in the record is 9.8 (critical), and no CISA KEV listing or confirmed exploitation appears in the sources consulted. No fixed version is listed in the record, so administrators should verify vendor updates and restrict untrusted file imports.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2020-37138 is a stack-based buffer overflow (CWE-121) in the file import feature of 10-Strike Network Inventory Explorer 9.03, as described in the CNA record from VulnCheck. The record states that a remote attacker may be able to execute arbitrary code by supplying a crafted text file.

Impact

  • The description states that successful exploitation can lead to arbitrary code execution.
  • The CVSS 3.1 base score of 9.8 (critical) is reported in the record, with a network attack vector, low complexity, no privileges and no user interaction.
  • The description also states that data execution prevention can be bypassed through a return-oriented programming technique.

Affected products and versions

  • The record explicitly names 10-Strike Network Inventory Explorer 9.03.
  • The structured affected-product list in the record is empty, so the full range of affected versions is unknown.
  • Vendor product information is available at 10-Strike Network Inventory Explorer.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so KEV reports no active exploitation.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • An Exploit-DB entry is referenced in the record; its content was not analyzed for this summary.

Remediation and mitigation

  • The record lists no fixed version. This does not mean no fix exists; check the vendor site and apply any available update.
  • Until a fix is verified, limit which users can supply files to the import feature and reduce network exposure of the application.
  • Treat files from untrusted sources as hostile and import them only in isolated or controlled environments.
  • Review the VulnCheck advisory for the researcher's description of the issue.

Detection guidance

  • Monitor for unexpected crashes or restarts of the application during file import operations.
  • Review application and host logs for abnormal child processes or unusual activity originating from the application process.
  • Apply endpoint and network monitoring consistent with your environment; the sources consulted do not provide specific detection signatures.

Limitations of the available information

  • The record does not provide a fixed version or a complete affected version range beyond 9.03.
  • Only CVSS scores from the CNA are present; no other provider scores are included in the record.
  • EPSS and SSVC data are not available in the record.
  • The record source status is Deferred, so details may change as sources are updated.

Frequently asked questions

Is CVE-2020-37138 known to be actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation in the wild appears in the sources consulted. An Exploit-DB entry is referenced, but its content was not analyzed here.

Which versions are affected and is there a fix?

The description names version 9.03. The record lists no fixed version and no full affected range, so check the vendor site for updates and verify any fix before relying on it.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.