Is CVE-2020-37211 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-37211 being exploited in the wild.

How severe is CVE-2020-37211?

High severity, with a CVSS score of 7.5, published 11 February 2026.

Is there a fix for CVE-2020-37211?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-37211 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2020-37211?

Check whether you run Nsasoft Spotim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37211: Nsasoft SpotIM buffer overflow in registration name field

CVE-2020-37211 · Severity: high · CVSS 7.5 · Published 2026-02-11

Nsasoft SpotIM, a tool used for recovering instant messenger passwords, contains a flaw that allows the application to be crashed. An attacker can trigger this by entering an excessively long name into the software's registration field. This results in a denial-of-service condition where the application becomes unresponsive or closes unexpectedly, potentially disrupting password recovery operations.

Vendors: Nsasoft.

Quick answers

Is CVE-2020-37211 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-37211 being exploited in the wild.
How severe is CVE-2020-37211?: High severity, with a CVSS score of 7.5, published 11 February 2026.
Which products and versions are affected?: Nsasoft Spotim 2.2.
Is there a fix for CVE-2020-37211?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-37211 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2020-37211?: Check whether you run Nsasoft Spotim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in Nsasoft SpotIM version 2.2 within the registration name input field. The vulnerability is triggered when the application fails to perform adequate bounds checking on the 'Name' field during the registration process. An attacker can achieve a denial-of-service (DoS) state by supplying a payload of approximately 1,000 characters, leading to an application crash. While some sources suggest a network vector, the primary exploit method involves local interaction with the application's registration interface on Windows 10. A public Proof of Concept (PoC) is available.

Affected products

Nsasoft SpotIM 2.2

Timeline

2020-01-06: disclosed: Initial exploit code published on Exploit-DB
2026-02-11: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.