# CVE-2020-37210: Nsasoft SpotIE buffer overflow in registration key input

Source: https://junglewise.ai/threats/cve-2020-37210-nsasoft-spotie-buffer-overflow-in-registration-key-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-11. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2020-37210 · Severity: high · CVSS 7.5 · Published 2026-02-11

SpotIE, a tool used for recovering Internet Explorer passwords and browser history, contains a flaw that allows the application to be crashed. An attacker can trigger this by entering an excessively long string of characters into the registration key field. This results in a denial of service, preventing legitimate users from using the software on the affected machine.

Vendors: [Nsasoft](https://junglewise.ai/threats/vendors/nsasoft).

## Quick answers

**Is CVE-2020-37210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-37210 being exploited in the wild.

**How severe is CVE-2020-37210?** High severity, with a CVSS score of 7.5, published 11 February 2026.

**Which products and versions are affected?** Nsasoft Spotie 2.9.5 and earlier.

**Is there a fix for CVE-2020-37210?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-37210 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2020-37210?** Check whether you run Nsasoft Spotie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic buffer overflow (CWE-120) exists in Nsasoft SpotIE version 2.9.5 and earlier. The vulnerability is located in the 'Key' input field within the registration dialog, which fails to properly validate the length of the input buffer. An attacker can trigger the vulnerability by supplying a payload of approximately 1,000 characters, leading to an application crash. While some CVSS metrics suggest a network vector, the exploit typically requires local interaction where a user or attacker pastes the malicious string into the software's registration interface. A public Proof of Concept (PoC) is available.

## Affected products

- Nsasoft (NSAuditor) SpotIE 2.9.5 and earlier

## Timeline

- 2020-01-06: disclosed: Initial exploit PoC published on Exploit-DB
- 2026-02-11: advisory: NVD/VulnCheck advisory published

## References

- [http://www.nsauditor.com/](http://www.nsauditor.com/)
- [https://www.exploit-db.com/exploits/47855](https://www.exploit-db.com/exploits/47855)
- [https://www.vulncheck.com/advisories/spotie-key-denial-of-service](https://www.vulncheck.com/advisories/spotie-key-denial-of-service)