CVE-2020-37168: Systempay 1.0 e-commerce: brute force of production secret key used for payment signatures (CWE-328)

Overview

The record describes a weak cryptographic implementation in Ecommerce Systempay 1.0. The payment signature key is a 16-character production secret, and the description states it can be recovered by iterative testing of candidate keys against signatures captured from payment form submissions. The record classifies the weakness as CWE-328 and was published by the CNA disclosure@vulncheck.com, with the NVD entry listed as Deferred.

Impact

• According to the description, an attacker who recovers the key could forge valid payment signatures.
• The description also states that transaction amounts could be manipulated.
• The record gives CVSS 3.1 9.8 (Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3, both provided by disclosure@vulncheck.com.

Affected products and versions

• The record identifies Ecommerce Systempay 1.0.
• The record's affected list is empty, so the exact range of affected versions is unknown from the sources in this record.
• The record's fixes list is empty. This does not mean no fix exists; the status of a fix is unknown.

Exploitation status

The CISA KEV entry is not listed for this CVE, so no confirmed active exploitation is recorded in KEV. The reference list includes an Exploit-DB entry (48017), but this analysis does not verify its contents or whether it has been used against real systems. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

• Treat this as a high-priority item for any organization running Systempay 1.0 for payment processing, given the critical CVSS scores.
• Contact Systempay or your payment integrator to confirm whether a fixed version or a replacement key-signing mechanism is available. The record does not provide this information.
• Review the official Systempay documentation for the signature mechanism, for example the Systempay documentation, to understand how production keys are generated, stored and rotated.
• Rotate the production key if there is any reason to believe it may have been exposed, and coordinate the change with the payment provider.
• Limit exposure of payment form data and signature values, and avoid logging them in plaintext.

Detection guidance

• Monitor payment transactions for unexpected amount changes or signature failures, and reconcile them with the payment provider's records.
• Review web and application logs for unusual volumes of requests to the payment endpoint that could indicate repeated probing of signed payloads.
• Correlate payment gateway alerts with changes in merchant account activity.

Limitations of the available information

The record does not include vendor advisories for Systempay, affected version ranges, fixed versions, or the precise conditions under which the key-recovery method works. The Exploit-DB entry and the VulnCheck advisory were listed as references but their content was not reviewed for this analysis. The EPSS data in the record is present but is not used here to judge risk.

Frequently asked questions

What is CVE-2020-37168?

It is a reported weakness in Ecommerce Systempay 1.0 where the 16-character production key used for payment signatures can be recovered by brute force, according to the record's description.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The record includes an Exploit-DB reference whose content was not verified here.

Is a fixed version available?

The record does not list any fixed version. The absence of a fix in the record does not confirm that none exists, so contact the vendor or your payment integrator.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.