Is CVE-2020-37197 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-37197 being exploited in the wild.

How severe is CVE-2020-37197?

High severity, with a CVSS score of 7.5, published 11 February 2026.

Which products and versions are affected?

Nsasoft Dnss Domain Name Search Software All versions up to and including 2020 releases.

Is there a fix for CVE-2020-37197?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-37197 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2020-37197?

Check whether you run Nsasoft Dnss Domain Name Search Software or Nsasoft Domain Name Search Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37197: Nsasoft Dnss Domain Name Search Software buffer overflow in Name field

CVE-2020-37197 · Severity: high · CVSS 7.5 · Published 2026-02-11

Nsasoft Dnss Domain Name Search Software, a tool used for network auditing and domain lookups, is vulnerable to a crash when processing long registration names. An attacker can cause the application to stop functioning by entering a specially crafted 1,000-character string into the registration name field. This results in a denial of service, preventing legitimate users from using the software until it is restarted.

Vendors: Nsasoft.

Quick answers

Is CVE-2020-37197 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-37197 being exploited in the wild.
How severe is CVE-2020-37197?: High severity, with a CVSS score of 7.5, published 11 February 2026.
Which products and versions are affected?: Nsasoft Dnss Domain Name Search Software All versions up to and including 2020 releases.
Is there a fix for CVE-2020-37197?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-37197 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2020-37197?: Check whether you run Nsasoft Dnss Domain Name Search Software or Nsasoft Domain Name Search Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in Nsasoft Dnss Domain Name Search Software due to insufficient input validation in the registration interface. The vulnerability is triggered when a user inputs a string exceeding 1,000 characters into the 'Name' field during the registration process. While some sources categorize the attack vector as local due to the requirement of interacting with the application UI, others note the lack of authentication requirements. Successful exploitation results in a memory corruption that crashes the application process, leading to a denial of service. A public Proof of Concept (PoC) exists demonstrating the crash using a 1,000-byte payload.

Affected products

Nsasoft (Nsauditor) Dnss Domain Name Search Software All versions up to and including 2020 releases

Timeline

2020-01-06: disclosed: Initial exploit and PoC published on Exploit-DB
2026-02-11: advisory: CVE published and NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.