CVE-2020-37095
Published: 07 February 2026
Description
Cyberoam Authentication Client 2.1.2.7 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) memory. Attackers can craft a malicious input in the 'Cyberoam Server Address' field to trigger a bind…
more
TCP shell on port 1337 with system-level access.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents buffer overflow exploitation by validating malicious inputs in the 'Cyberoam Server Address' field.
Implements memory safeguards like DEP and ASLR to protect against SEH overwrite attacks leading to arbitrary code execution.
Ensures timely patching and remediation of the buffer overflow flaw in Cyberoam Authentication Client version 2.1.2.7.
Security SummaryAI
CVE-2020-37095 is a buffer overflow vulnerability (CWE-121) affecting the Cyberoam Authentication Client version 2.1.2.7. The flaw enables remote attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) memory. It is triggered via a specially crafted malicious input in the 'Cyberoam Server Address' field, earning a critical CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows attackers to gain system-level access by triggering a bind TCP shell on port 1337.
References include an Exploit-DB entry at https://www.exploit-db.com/exploits/48148 detailing a public exploit, a Vulncheck advisory at https://www.vulncheck.com/advisories/cyberoam-authentication-client-buffer-overflow-seh, and software information at https://cyberoam-general-authentication-client.software.informer.com/2.1/. No specific patches or mitigations are detailed in the provided description or references.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client software enables remote code execution without authentication or user interaction, directly facilitating Exploitation for Client Execution (T1203).