CVE Intelligence
Analysis AI-assisted

CVE-2020-37159: Parallaxis Cuckoo Clock 5.0 Buffer Overflow in Alarm Scheduling

A buffer overflow in the alarm scheduling feature of Parallaxis Cuckoo Clock 5.0 is classified as CWE-121, with a CVSS 3.1 base score of 9.8 recorded from VulnCheck. The record lists no affected or fixed versions and no CISA KEV listing, so remediation details and exploitation status are largely unknown.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a buffer overflow in the alarm scheduling feature of Parallaxis Cuckoo Clock 5.0, classified as CWE-121 (Stack-based Buffer Overflow). The main supporting references are the VulnCheck advisory and the NVD entry.

Impact

  • According to the description, memory register overwrites can lead to arbitrary code execution, with potential remote code execution.
  • The record scores the issue CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, no privileges and no user interaction, with high impact to confidentiality, integrity and availability.
  • A CVSS 4.0 score of 8.4 is also recorded from the same CNA.

Affected products and versions

  • The record names Parallaxis Cuckoo Clock 5.0 as the affected product.
  • The structured affected list is empty, so the full range of affected versions is unknown beyond the version named in the description.

Exploitation status

  • The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.
  • The record references an Exploit-DB entry (48087). Its presence in the references does not by itself establish how widely the issue is exploited.
  • The recorded EPSS probability is 0.00693 with a percentile of 0.51645.

Remediation and mitigation

  • No fixed version is recorded. The absence of a fix in the record does not mean none exists, so check the vendor and the VulnCheck advisory.
  • Until a vendor fix is confirmed, consider removing or restricting exposure of the affected application, limiting network access to it and applying compensating controls such as network segmentation.
  • Identify whether the software is installed in your environment, including on endpoints where it may have been deployed informally.

Detection guidance

  • Inventory systems for Parallaxis Cuckoo Clock installations and record the installed version.
  • Monitor for unexpected crashes or abnormal termination of the alarm scheduling component, which may indicate malformed input handling.
  • Review application logs for unusual input and for signs of unexpected process behavior.

Limitations of the available information

  • The record does not include a vendor advisory, affected version ranges, fixed versions or technical details beyond the description.
  • The published date in the record (2026-02-07) differs from the year in the identifier (2020). Verify the timeline against the official CVE record.
  • CVSS and EPSS values are reproduced as recorded and should be checked against their original sources.

Frequently asked questions

What is CVE-2020-37159?

It is a buffer overflow in the alarm scheduling feature of Parallaxis Cuckoo Clock 5.0, classified as CWE-121 in the record.

How severe is it according to the record?

The record lists a CVSS 3.1 base score of 9.8 (Critical) and a CVSS 4.0 score of 8.4, both from VulnCheck.

Is there a fixed version?

No fixed version is listed in the record. That does not confirm that no fix exists, so check the vendor and the VulnCheck advisory.

Is it known to be exploited in the wild?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.