CVE-2020-37025

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

Port Forwarding Wizard 4.8.0 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code through a long request in the Register feature. Attackers can craft a malicious payload with an egg tag and overwrite SEH handlers to potentially execute shellcode on vulnerable Windows systems.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2020

CVE-2020-370265.3Sickbeard alpha contains a cross-site request forgery vulnerability that allows attackers to disable authentication by submitting crafted co CVE-2020-370279.8Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands throug CVE-2020-370288.4Socusoft Photo to Video Converter Professional 8.07 contains a local buffer overflow vulnerability in the 'Output Folder' input field that a CVE-2020-370298.4FTPDummy 4.80 contains a local buffer overflow vulnerability in its preference file handling that allows attackers to execute arbitrary code CVE-2020-37039.8u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central CVE-2020-370307.8Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with ele CVE-2020-370318.4Simple Startup Manager 1.17 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting me CVE-2020-370328.8Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute CVE-2020-370338.2Infor Storefront B2B 1.0 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'usr_name' CVE-2020-370347.5HelloWeb 2.0 contains an arbitrary file download vulnerability that allows remote attackers to download system files by manipulating filepat CVE-2020-370358.2e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database CVE-2020-370368.4RM Downloader 2.50.60 contains a local buffer overflow vulnerability in the 'Load' parameter that allows attackers to execute arbitrary code