# CVE-2020-37204: NSAuditor RemShutdown buffer overflow in registration key input

Source: https://junglewise.ai/threats/cve-2020-37204-nsauditor-remshutdown-buffer-overflow-in-registration-key-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-11. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2020-37204 · Severity: high · CVSS 7.5 · Published 2026-02-11

NSAuditor RemShutdown, a tool used for remote computer management and shutdown tasks, is vulnerable to a flaw that can cause the application to crash. An attacker can trigger this by entering an excessively long registration key into the software's activation field. This results in a denial-of-service, preventing legitimate users from using the application until it is restarted.

Vendors: [Nsasoft](https://junglewise.ai/threats/vendors/nsasoft).

## Quick answers

**Is CVE-2020-37204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-37204 being exploited in the wild.

**How severe is CVE-2020-37204?** High severity, with a CVSS score of 7.5, published 11 February 2026.

**Which products and versions are affected?** NSAuditor RemShutdown 2.9.0.0.

**Is there a fix for CVE-2020-37204?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-37204 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2020-37204?** Check whether you run Nsasoft Remshutdown. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic buffer overflow (CWE-120) exists in NSAuditor RemShutdown version 2.9.0.0. The vulnerability is located in the registration key input component, which fails to properly validate the length of the input buffer before copying it. An attacker can exploit this by pasting a 1000-character string into the 'Key' field under the 'Register' menu. This action triggers an application crash (Denial of Service). While the attack requires local access and user interaction to paste the payload, it demonstrates a lack of bounds checking on user-supplied strings. No official patch is currently noted in the advisory.

## Affected products

- NSAuditor RemShutdown 2.9.0.0

## Timeline

- 2020-01-06: disclosed: Initial exploit PoC published on Exploit-DB
- 2026-02-11: advisory: CVE published and added to NVD

## References

- [http://www.nsauditor.com/](http://www.nsauditor.com/)
- [https://www.exploit-db.com/exploits/47863](https://www.exploit-db.com/exploits/47863)
- [https://www.vulncheck.com/advisories/remshutdown-key-denial-of-service](https://www.vulncheck.com/advisories/remshutdown-key-denial-of-service)

## Related threats

- [Nsasoft RemShutdown buffer overflow in Name registration field](https://junglewise.ai/threats/cve-2020-37205-nsasoft-remshutdown-buffer-overflow-in-name-registration-field)