CVE-2020-37095

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Cyberoam Authentication Client 2.1.2.7 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) memory. Attackers can craft a malicious input in the 'Cyberoam Server Address' field to trigger a bind TCP shell on port 1337 with system-level access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2020

CVE-2020-370964.3Edimax EW-7438RPn 1.13 contains a cross-site request forgery vulnerability in the MAC filtering configuration interface. Attackers can craft CVE-2020-370977.5Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencryp CVE-2020-370987.8Disk Sorter Enterprise 12.4.16 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with el CVE-2020-370997.8Disk Savvy Enterprise 12.3.18 contains an unquoted service path vulnerability in its service configuration that allows local attackers to po CVE-2020-37107.8Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code CVE-2020-371007.8Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with el CVE-2020-371017.8VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the servi CVE-2020-371027.8Adaware Web Companion 4.9.2159 contains an unquoted service path vulnerability in the WCAssistantService that allows local attackers to pote CVE-2020-371035.4DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executab CVE-2020-371047.5ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by pred CVE-2020-371057.1PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrar CVE-2020-371065.3Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles witho