---METADATA---
VENDOR: Adaware
PRODUCT: Web Companion
AFFECTED_VERSIONS: 4; See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in Adaware Web Companion 4 could allow for unauthorized privilege escalation or system interference on the local machine.

Executive Summary:
Adaware Web Companion 4 is affected by a high-severity vulnerability that could allow an attacker to compromise the security of the host system.

Vulnerability Details

CVE-ID: CVE-2020-37102

Affected Software: Adaware Web Companion

Affected Versions: 4

Vulnerability: This vulnerability exists in Adaware Web Companion 4. Given the CVSS score of 7.8, it likely involves a flaw in the software's service or update mechanism that could be exploited by a local attacker to escalate privileges or bypass security features.

Business Impact

A successful exploit could allow an attacker to disable security protections on an endpoint or gain administrative control over the local system. This increases the risk of malware infection and data theft on employee workstations.

Remediation Plan

Immediate Action: Uninstall Adaware Web Companion 4 or update it to the latest version provided by the vendor.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for unusual process behavior originating from security software components.

Compensating Controls: Implement the principle of least privilege on all workstations to limit the potential for local privilege escalation attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Security software vulnerabilities are often targeted to blind other security controls on a system.

Analyst Recommendation

We recommend that IT administrators identify and update or remove Adaware Web Companion 4 from all managed endpoints. Ensuring that endpoint security tools are themselves secure is a fundamental requirement for a robust defense-in-depth strategy.

---METADATA---
VENDOR: KeepSolid
PRODUCT: VPN Unlimited 6
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
VPN Unlimited 6 is affected by a high-severity vulnerability that could compromise the security of encrypted tunnels or lead to local privilege escalation.

Executive Summary:
VPN Unlimited 6 contains a high-severity vulnerability that threatens the privacy and security of the user's encrypted communications.

Vulnerability Details

CVE-ID: CVE-2020-37101

Affected Software: KeepSolid VPN Unlimited 6

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability in VPN Unlimited 6 likely involves a flaw in how the application handles system-level privileges or manages secure connections. With a CVSS score of 7.8, it represents a significant risk where an attacker could potentially intercept traffic or gain unauthorized access on the local machine.

Business Impact

For organizations relying on VPNs to secure remote work, this flaw is critical. A compromise could lead to the exposure of sensitive corporate data being transmitted over the VPN or allow an attacker to bypass internal security perimeters. The 7.8 CVSS score indicates a high impact on the confidentiality of business communications.

Remediation Plan

Immediate Action: Update VPN Unlimited to the latest available version to ensure all security patches are applied.

Proactive Monitoring: Review endpoint security logs for any unauthorized attempts to modify VPN configuration files or unexpected behavior from the VPN client service.

Compensating Controls: Ensure that all remote access requires Multi-Factor Authentication (MFA) and that endpoints are protected by updated EDR/AV solutions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. As a late-disclosure vulnerability, it is essential to ensure no legacy clients remain in use within the organization.

Analyst Recommendation

The security of the VPN tunnel is the cornerstone of remote work safety. Given the 7.8 CVSS score, administrators must ensure all users have updated their VPN Unlimited software to a supported version immediately to prevent potential data interception or privilege escalation.

---METADATA---
VENDOR: Flexense
PRODUCT: Sync Breeze Enterprise
AFFECTED_VERSIONS: 12; See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in Sync Breeze Enterprise 12 could allow for unauthorized file synchronization or system access.

Executive Summary:
Sync Breeze Enterprise 12 contains a high-severity vulnerability that could allow an attacker to manipulate file synchronization tasks and compromise data.

Vulnerability Details

CVE-ID: CVE-2020-37100

Affected Software: Sync Breeze Enterprise

Affected Versions: 12

Vulnerability: This vulnerability is present in Sync Breeze Enterprise 12. With a CVSS score of 7.8, the flaw likely permits an attacker to interfere with synchronization processes or gain unauthorized access to the management server, potentially through the web-based interface.

Business Impact

Exploitation of this vulnerability could result in the unauthorized copying of sensitive data to external locations or the corruption of synchronized files. This poses a direct threat to data integrity and confidentiality across the enterprise.

Remediation Plan

Immediate Action: Update Sync Breeze Enterprise 12 to the latest patched version provided by the vendor immediately.

Proactive Monitoring: Monitor synchronization logs for any new or modified tasks that were not initiated by authorized administrators.

Compensating Controls: Disable the web management interface if it is not required, or restrict its access to a dedicated management network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. The nature of synchronization software makes it a high-value target for data exfiltration.

Analyst Recommendation

It is critical to apply the available patches for Sync Breeze Enterprise 12 immediately. Organizations should ensure that all file synchronization tools are properly secured to prevent unauthorized data movement and maintain system integrity.

---METADATA---
VENDOR: Flexense
PRODUCT: Disk Savvy Enterprise
AFFECTED_VERSIONS: 12; See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in Disk Savvy Enterprise 12 could allow attackers to gain unauthorized access to disk space analysis data or the host system.

Executive Summary:
Disk Savvy Enterprise 12 is vulnerable to a high-severity security flaw that could lead to unauthorized access and system compromise.

Vulnerability Details

CVE-ID: CVE-2020-37099

Affected Software: Disk Savvy Enterprise

Affected Versions: 12

Vulnerability: This vulnerability affects Disk Savvy Enterprise 12. The CVSS score of 7.8 suggests a significant flaw in the application's handling of requests or permissions, potentially allowing an attacker to bypass security controls in the management console.

Business Impact

An attacker could exploit this flaw to view sensitive file system information or disrupt disk management operations. This could lead to the exposure of confidential data locations and facilitate further attacks against the organization's storage infrastructure.

Remediation Plan

Immediate Action: Apply the vendor's security update for Disk Savvy Enterprise 12 immediately.

Proactive Monitoring: Audit the system for any unauthorized changes to disk analysis reports or configuration settings within the Disk Savvy environment.

Compensating Controls: Use network segmentation to isolate the disk management server and ensure that all administrative traffic is encrypted and authenticated.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Like other Flexense products in this batch, the late disclosure warrants a thorough review of existing installations.

Analyst Recommendation

Immediate patching is advised to mitigate the risks associated with this high-severity vulnerability. Protecting disk management tools is essential for maintaining the overall security and confidentiality of the enterprise file system.

---METADATA---
VENDOR: Flexense
PRODUCT: Disk Sorter Enterprise
AFFECTED_VERSIONS: 12; See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in Disk Sorter Enterprise 12 could allow for unauthorized administrative actions or system compromise.

Executive Summary:
Disk Sorter Enterprise 12 contains a high-severity security flaw that could allow an attacker to compromise the host system's data integrity.

Vulnerability Details

CVE-ID: CVE-2020-37098

Affected Software: Disk Sorter Enterprise

Affected Versions: 12

Vulnerability: This vulnerability resides in the Disk Sorter Enterprise 12 management interface or core service. With a CVSS score of 7.8, it likely involves a flaw that allows an authenticated or unauthenticated attacker to execute unauthorized commands or access sensitive file system metadata.

Business Impact

Successful exploitation could lead to unauthorized file manipulation, data loss, or the exposure of file system structures across the enterprise. This poses a significant risk to organizational data management and could be used as a stepping stone for further network infiltration.

Remediation Plan

Immediate Action: Upgrade Disk Sorter Enterprise to the latest version immediately to address this vulnerability.

Proactive Monitoring: Monitor for unusual service restarts or administrative logins to the Disk Sorter web interface from unrecognized IP addresses.

Compensating Controls: Restrict access to the Disk Sorter management ports (typically TCP 8080) to authorized administrative workstations only via host-based firewalls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late disclosure highlights the need to audit legacy enterprise software for unpatched vulnerabilities.

Analyst Recommendation

We recommend an immediate update of Disk Sorter Enterprise 12. Maintaining up-to-date enterprise management software is critical for preventing unauthorized access to the underlying storage infrastructure.

---METADATA---
VENDOR: Edimax
PRODUCT: EW-7438RPn
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Edimax EW-7438RPn range extender that could allow for unauthorized access or system compromise.

Executive Summary:
The Edimax EW-7438RPn range extender contains a high-severity vulnerability that could allow an attacker to compromise the device and intercept network traffic.

Vulnerability Details

CVE-ID: CVE-2020-37097

Affected Software: Edimax EW-7438RPn

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the Edimax EW-7438RPn hardware. While technical specifics are limited in the late disclosure, the high CVSS score suggests a critical failure in the device's management interface or network stack, likely exploitable by an unauthenticated attacker on the local network.

Business Impact

A successful exploit of this range extender could lead to a complete compromise of the local network infrastructure. Attackers could perform man-in-the-middle (MitM) attacks, redirecting or capturing sensitive data transmitted by connected users. With a CVSS score of 7.5, the risk to confidentiality and integrity is significant, potentially leading to the exposure of corporate credentials or internal communications.

Remediation Plan

Immediate Action: Administrators should immediately check for and apply the latest firmware updates from the Edimax support portal to mitigate this flaw.

Proactive Monitoring: Monitor network traffic originating from IoT and networking hardware for unusual outbound connections or unauthorized configuration changes.

Compensating Controls: Isolate range extenders and similar networking hardware on a dedicated management VLAN with strict access control lists (ACLs) to prevent lateral movement.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its late disclosure, the potential for exploitation remains a high priority for organizations using legacy networking hardware.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate remediation. Organizations should prioritize updating the firmware on all Edimax EW-7438RPn devices or consider replacing end-of-life hardware that no longer receives security patches to maintain a robust security posture.

---METADATA---
VENDOR: Cyberoam
PRODUCT: Authentication Client
AFFECTED_VERSIONS: 2.1.2.7
---END_METADATA---

Description Summary:
Buffer overflow in Cyberoam Authentication Client 2.1.2.7 allows remote attackers to execute arbitrary code by overwriting SEH memory via a crafted server address.

Executive Summary:
A critical buffer overflow in the Cyberoam Authentication Client enables remote attackers to gain system-level access by overwriting memory via a crafted server address.

Vulnerability Details

CVE-ID: CVE-2020-37095

Affected Software: Cyberoam Authentication Client

Affected Versions: 2.1.2.7

Vulnerability: This is a stack-based buffer overflow vulnerability triggered by malicious input in the "Cyberoam Server Address" field. An unauthenticated remote attacker can provide a specially crafted string that overwrites the Structured Exception Handler (SEH), leading to the execution of arbitrary code and the establishment of a bind TCP shell on port 1337.

Business Impact

The impact of this vulnerability is severe, as it allows for complete system takeover with system-level privileges. With a CVSS score of 9.8, the flaw poses a significant risk of data exfiltration and persistent unauthorized access to corporate endpoints.

Remediation Plan

Immediate Action: Update all Cyberoam Authentication Client installations to the latest available version provided by the vendor.

Proactive Monitoring: Monitor network traffic for unauthorized connections on TCP port 1337 and audit endpoint logs for suspicious memory corruption events.

Compensating Controls: Restrict access to the authentication client's input fields through group policies and deploy Endpoint Detection and Response (EDR) solutions to block shellcode execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 7, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure of a legacy issue, but the high CVSS score necessitates immediate remediation for any remaining legacy deployments.

Analyst Recommendation

Given the ability to achieve a system-level bind shell, this vulnerability represents a maximum-severity risk. Organizations must prioritize the removal or update of version 2.1.2.7 across all workstations to prevent remote exploitation.

---METADATA---
VENDOR: EspoCRM
PRODUCT: EspoCRM
AFFECTED_VERSIONS: 5.8.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
EspoCRM 5.8.5 is vulnerable to an authentication bypass via manipulation of authorization headers, allowing unauthorized access to administrative user information and privileges.

Executive Summary:
A critical authentication vulnerability in EspoCRM 5.8.5 allows unauthenticated attackers to hijack user accounts and escalate privileges to administrative levels.

Vulnerability Details

CVE-ID: CVE-2020-37094

Affected Software: EspoCRM

Affected Versions: 5.8.5

Vulnerability: This vulnerability involves the improper handling of Basic Authorization and Espo-Authorization tokens. Attackers can decode and modify these headers to bypass authentication mechanisms and impersonate other users, including administrators.

Business Impact

The ability for an attacker to gain unauthorized administrative access poses a severe threat to data integrity, confidentiality, and system availability. Given the CVSS score of 9.8, this vulnerability could lead to total system compromise, theft of sensitive customer data, and unauthorized modification of business records.

Remediation Plan

Immediate Action: Upgrade to the latest available version of EspoCRM provided by the vendor to remediate the header manipulation flaw.

Proactive Monitoring: Review application access logs for anomalous authorization header patterns or unauthorized access attempts to administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate authorization headers for malformed or suspicious token strings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk that requires immediate attention. Organizations utilizing EspoCRM 5.8.5 should prioritize patching to the latest version to prevent unauthorized administrative access and potential data exfiltration.

---METADATA---
VENDOR: Netis
PRODUCT: E1+ Range Extender
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the Netis E1+ 1 range extender could allow for unauthorized device manipulation. This flaw is distinct from other reported issues for the same product line and affects core firmware components.

Executive Summary:
A high-severity vulnerability in the Netis E1+ 1 device could permit an attacker to take control of the networking hardware, leading to a compromise of the local network environment.

Vulnerability Details

CVE-ID: CVE-2020-37093

Affected Software: Netis E1+

Affected Versions: See vendor advisory

Vulnerability: This vulnerability affects the Netis E1+ 1. Similar to other flaws in this product line, it likely stems from improper input validation or insecure default configurations in the firmware, which could be exploited by an unauthenticated attacker with network access to the device.

Business Impact

The impact of a compromised network extender includes the potential for man-in-the-middle (MitM) attacks, data theft, and the loss of network availability. A CVSS score of 7.5 highlights the High severity of this risk, as it directly undermines the security perimeter of the organization's physical network infrastructure.

Remediation Plan

Immediate Action: Immediately update the Netis E1+ firmware to the most recent version provided by the manufacturer.

Proactive Monitoring: Perform regular audits of network device logs and monitor for unexpected firmware modifications or configuration changes.

Compensating Controls: Isolate IoT and network infrastructure devices on a separate VLAN to limit the potential impact of a device compromise on the primary corporate network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late-disclosed vulnerability (originally from 2020) emphasizes the ongoing risk posed by legacy networking hardware that may not be regularly audited for security.

Analyst Recommendation

It is critical to apply the necessary firmware updates immediately. Given the High CVSS score, any delay in remediation could leave the network vulnerable to attackers seeking to exploit unpatched infrastructure for data exfiltration or as a platform for further attacks.

---METADATA---
VENDOR: Netis
PRODUCT: E1+ Range Extender
AFFECTED_VERSIONS: Version 1
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Netis E1+ version 1 range extender. This flaw resides in the device's firmware and could allow for unauthorized access to the network device.

Executive Summary:
The Netis E1+ range extender (Version 1) contains a high-severity vulnerability that could allow an attacker to compromise the device and gain unauthorized access to the local network.

Vulnerability Details

CVE-ID: CVE-2020-37092

Affected Software: Netis E1+

Affected Versions: Version 1

Vulnerability: This vulnerability affects the firmware of the Netis E1+ version 1. It likely involves a flaw in the web management interface or the device's handling of network requests, potentially allowing an unauthenticated attacker to gain administrative control over the range extender.

Business Impact

A compromised range extender can serve as a persistent foothold for an attacker within a network, allowing for traffic interception and lateral movement. With a CVSS score of 7.5, this High severity vulnerability poses a significant risk to network privacy and the security of all devices connected through the extender.

Remediation Plan

Immediate Action: Apply the latest firmware updates from Netis for the E1+ device. If the device has reached end-of-life (EOL), it should be replaced with a currently supported model.

Proactive Monitoring: Check for unauthorized changes to the device's configuration, such as modified DNS settings or unknown administrative accounts.

Compensating Controls: Disable remote management of the device from the WAN side and ensure the local management interface is protected by a strong, unique password.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. However, networking equipment is frequently targeted by botnets and state-sponsored actors for long-term surveillance and network disruption.

Analyst Recommendation

The High CVSS score and the potential for network-wide impact make this a critical issue. Administrators must ensure that all Netis E1+ devices are updated or decommissioned if patches are unavailable to prevent them from being used as entry points for attackers.

---METADATA---
VENDOR: School ERP Pro
PRODUCT: School ERP Pro
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
School ERP Pro 1.0 contains an unrestricted file upload vulnerability in its messaging system, allowing attackers to execute arbitrary PHP code on the server.

Executive Summary:
An arbitrary file upload vulnerability in School ERP Pro 1.0 enables remote attackers to achieve remote code execution (RCE) by uploading malicious PHP scripts.

Vulnerability Details

CVE-ID: CVE-2020-37090

Affected Software: School ERP Pro

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize or restrict file types uploaded via the messaging system's attachment feature. This allows an attacker to upload executable PHP files, which can then be triggered to execute arbitrary code within the server environment.

Business Impact

With a CVSS score of 9.8, this flaw allows for complete server compromise. Successful exploitation grants attackers the ability to execute commands with the privileges of the web server, leading to potential ransomware deployment, data theft, and full control over the application's underlying infrastructure.

Remediation Plan

Immediate Action: Update to the latest version of School ERP Pro to ensure that file upload validation mechanisms are correctly implemented.

Proactive Monitoring: Monitor server directories where uploads are stored for suspicious files or unexpected script execution attempts.

Compensating Controls: Implement strict server-side file type validation and restrict the execution of scripts within the upload directory via web server configuration settings (e.g., .htaccess or Nginx location blocks).

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote Code Execution (RCE) vulnerabilities are of the highest severity. Administrators must update School ERP Pro immediately and audit the system for any signs of existing unauthorized file uploads or persistent backdoors.

---METADATA---
VENDOR: School ERP Pro
PRODUCT: School ERP Pro
AFFECTED_VERSIONS: 1; See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in School ERP Pro 1 could allow unauthorized access to sensitive educational and personal data.

Executive Summary:
School ERP Pro version 1 is affected by a high-severity vulnerability that poses a significant risk to the confidentiality of student and staff records.

Vulnerability Details

CVE-ID: CVE-2020-37089

Affected Software: School ERP Pro

Affected Versions: 1

Vulnerability: This vulnerability affects the School ERP Pro 1 platform. Given the CVSS score of 8.2, it likely involves a flaw that allows an attacker to bypass authentication or escalate privileges to access sensitive database records containing personal identifiable information (PII).

Business Impact

The impact of this vulnerability is severe, potentially leading to the exposure of student records, financial data, and staff information. Such a breach could result in legal liabilities, regulatory fines (e.g., GDPR or FERPA), and irreparable reputational damage to the educational institution.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor for School ERP Pro 1 immediately.

Proactive Monitoring: Review database access logs for any unauthorized queries or bulk exports of student and personnel data.

Compensating Controls: Ensure the ERP system is not directly exposed to the public internet and require Multi-Factor Authentication (MFA) for all user accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This is a late-disclosure vulnerability, meaning legacy systems are at heightened risk if they have not been maintained.

Analyst Recommendation

Educational institutions using School ERP Pro 1 must act urgently to secure their systems. Applying the vendor's patch is the only definitive way to protect sensitive data from unauthorized access and potential exploitation.

---METADATA---
VENDOR: School ERP Pro
PRODUCT: School ERP Pro 1
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
School ERP Pro 1 is vulnerable to a high-severity security flaw that could lead to unauthorized access to sensitive educational and administrative data.

Executive Summary:
School ERP Pro 1 is affected by a high-severity vulnerability that risks the exposure of sensitive student and administrative information.

Vulnerability Details

CVE-ID: CVE-2020-37088

Affected Software: School ERP Pro School ERP Pro 1

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability in School ERP Pro 1 represents a significant security gap in the application’s logic or data handling. With a CVSS score of 7.5, it likely permits an attacker—potentially unauthenticated depending on the deployment—to access or manipulate sensitive records within the ERP system.

Business Impact

The impact of a successful exploit is severe, involving the potential leak of Personally Identifiable Information (PII) of students and staff. Such a breach could result in regulatory non-compliance, legal liabilities, and irreparable damage to the institution's reputation. The 7.5 CVSS score highlights a high risk to data confidentiality and integrity.

Remediation Plan

Immediate Action: Apply all available security patches for School ERP Pro 1 or migrate to a more recent, supported version of the software.

Proactive Monitoring: Audit database access logs for unusual queries and monitor for bulk data exports that could indicate an active breach.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious traffic and restrict access to the ERP interface to internal networks or via a secure VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure, but the sensitivity of the data managed by ERP systems makes this a high-priority fix for educational institutions.

Analyst Recommendation

The protection of student data is paramount, and the 7.5 CVSS score indicates a serious flaw that must be addressed. Administrators should apply vendor patches immediately and ensure that the application is not exposed directly to the public internet without robust security layers.

---METADATA---
VENDOR: VirtualTablet
PRODUCT: VirtualTablet Server
AFFECTED_VERSIONS: Version 3
---END_METADATA---

Description Summary:
VirtualTablet Server 3 contains a security vulnerability that could be exploited to perform unauthorized actions on the host system. This affects the server component responsible for receiving input from remote devices.

Executive Summary:
A high-severity vulnerability in VirtualTablet Server 3 could allow an attacker to compromise the host system by exploiting the communication channel between the server and remote tablet devices.

Vulnerability Details

CVE-ID: CVE-2020-37085

Affected Software: VirtualTablet VirtualTablet Server

Affected Versions: Version 3

Vulnerability: This vulnerability affects the VirtualTablet Server 3 application. Given its function as a network-based input server, the flaw likely involves improper validation of data received from unauthenticated remote clients, potentially leading to unauthorized command execution or service disruption.

Business Impact

A successful exploit could allow an attacker to gain control over the host machine or disrupt the input services required for creative work. The CVSS score of 7.5 reflects a High severity risk, particularly in environments where these servers are exposed to the network, potentially leading to broader lateral movement within the organization.

Remediation Plan

Immediate Action: Update VirtualTablet Server to the latest version immediately. If the software is no longer supported, consider migrating to a secure alternative.

Proactive Monitoring: Monitor for unexpected network traffic on the ports used by VirtualTablet Server and check for unauthorized processes running with the server's privileges.

Compensating Controls: Use a host-based firewall to restrict access to the VirtualTablet Server port to only known, authorized client IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This is a late disclosure for a 2020 vulnerability, which may indicate that researchers have recently found a way to weaponize the flaw in legacy environments.

Analyst Recommendation

Organizations using VirtualTablet Server 3 should treat this as a high-priority patch. The potential for unauthorized network-based access to a host system via an input driver is a significant security risk that must be addressed through immediate updates and network isolation.

---METADATA---
VENDOR: PHP AddressBook
PRODUCT: PHP AddressBook
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
PHP AddressBook 9 is vulnerable to a high-severity security flaw that could allow for unauthorized data access or system manipulation.

Executive Summary:
PHP AddressBook 9 contains a high-severity vulnerability that could lead to the exposure of sensitive contact information and compromise of the application server.

Vulnerability Details

CVE-ID: CVE-2020-37083

Affected Software: PHP AddressBook PHP AddressBook

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects PHP AddressBook version 9. With a CVSS score of 8.2, it likely involves a critical flaw such as SQL injection or a broken authentication mechanism that allows an unauthenticated attacker to access or modify the address book database.

Business Impact

The compromise of an address book application leads directly to the loss of Confidentiality, Integrity, and Availability (CIA) for contact data. This information is often used for phishing or social engineering attacks against employees. The high CVSS score reflects the significant risk of data exfiltration and potential administrative takeover.

Remediation Plan

Immediate Action: Immediately update PHP AddressBook to the latest secure version or disable the application if it is no longer required for business operations.

Proactive Monitoring: Review database logs for unusual query patterns and monitor for unauthorized administrative logins.

Compensating Controls: Place the application behind a VPN or use strict IP-based access controls to limit exposure to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late disclosure highlights a long-standing risk that should be remediated before public exploit code is developed.

Analyst Recommendation

The CVSS score of 8.2 indicates a high level of urgency. Security administrators must prioritize patching this application or migrating to a more modern, secure contact management solution to prevent data loss.

---METADATA---
VENDOR: webERP
PRODUCT: webERP
AFFECTED_VERSIONS: 4.15.1
---END_METADATA---

Description Summary:
An unauthenticated file access vulnerability in webERP 4.15.1 allows remote attackers to download database backup files directly from the web directory.

Executive Summary:
webERP 4.15.1 is vulnerable to a critical data exposure flaw that allows unauthenticated attackers to download entire database backups, compromising all corporate financial and operational data.

Vulnerability Details

CVE-ID: CVE-2020-37082

Affected Software: webERP

Affected Versions: 4.15.1

Vulnerability: The application stores database backups in a predictable web-accessible directory (companies/weberp/) without proper access controls. An unauthenticated attacker can download these files by guessing or discovering the timestamp-based filename.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a total loss of confidentiality. Since webERP manages sensitive business data, including financials, customer lists, and inventory, the exposure of a full SQL backup allows an attacker to replicate the entire business database offline for malicious use.

Remediation Plan

Immediate Action: Update webERP to the latest version and move all backup directories outside of the web server's document root immediately.

Proactive Monitoring: Check web server access logs for requests to the companies/weberp/ directory and any files ending in .sql.gz.

Compensating Controls: Use .htaccess or server configuration files to deny all web access to the backup directories and implement strong authentication for any directory containing sensitive exports.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. However, the predictable nature of the backup filenames makes this a trivial vulnerability to exploit once the directory structure is known.

Analyst Recommendation

Immediate isolation of backup files is required. Administrators must ensure that no sensitive data, especially database backups, is ever stored in a location reachable by a web browser without robust authentication and authorization checks.

---METADATA---
VENDOR: webTareas
PRODUCT: webTareas
AFFECTED_VERSIONS: 2.0.p8
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php component, allowing attackers to delete arbitrary files on the server.

Executive Summary:
A file deletion vulnerability in the webTareas 2.0.p8 administration component allows attackers to delete critical system files, potentially leading to denial-of-service or system instability.

Vulnerability Details

CVE-ID: CVE-2020-37080

Affected Software: webTareas

Affected Versions: 2.0.p8

Vulnerability: The 'print_layout.php' component fails to properly validate the 'atttmp1' parameter, allowing an attacker to traverse directories and delete arbitrary files. While the description notes the requirement for authentication, it also highlights an unauthenticated file deletion mechanism, indicating a severe flaw in access control.

Business Impact

The ability to delete arbitrary files on the server can result in a complete Denial of Service (DoS) by removing critical configuration or system files. With a CVSS score of 9.8, the potential for catastrophic system failure and data loss is extreme, necessitating urgent remediation.

Remediation Plan

Immediate Action: Update webTareas to the latest version to patch the file deletion logic in the administration component.

Proactive Monitoring: Monitor filesystem integrity and log file deletion events, specifically looking for unauthorized access to the 'print_layout.php' component.

Compensating Controls: Restrict access to the administration interface to trusted IP addresses and ensure the application runs with the minimum necessary filesystem permissions to limit the impact of potential deletions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a severe risk to system stability. Administrators should apply the vendor-provided patch immediately and review access control configurations to ensure that only authorized personnel can interact with administrative components.

---METADATA---
VENDOR: i-doit
PRODUCT: Open Source CMDB
AFFECTED_VERSIONS: 1.x; See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in i-doit Open Source CMDB 1 allows for potential unauthorized access or manipulation of configuration management data within the application environment.

Executive Summary:
i-doit Open Source CMDB version 1 contains a high-severity vulnerability that could allow an attacker to compromise sensitive IT infrastructure data.

Vulnerability Details

CVE-ID: CVE-2020-37078

Affected Software: i-doit Open Source CMDB

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in the i-doit Open Source CMDB 1 platform. While the description is concise, the CVSS score indicates a significant risk, likely involving an unauthenticated or low-privileged attacker gaining unauthorized access to the configuration management database.

Business Impact

A successful exploit could lead to the total exposure of an organization's IT asset landscape, including server configurations, network topologies, and sensitive credentials. Given the CVSS score of 8.8, this vulnerability poses a high risk to data confidentiality and integrity, potentially enabling further lateral movement within the corporate network.

Remediation Plan

Immediate Action: Administrators should immediately upgrade i-doit instances to the latest patched version provided by the vendor to mitigate unauthorized access risks.

Proactive Monitoring: Security teams should review application access logs for unusual administrative activity or bulk data exports originating from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common exploit patterns targeting CMDB software and restrict access to the management interface via VPN or IP whitelisting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score and the late disclosure nature of this entry, the potential for exploitation remains a significant concern for legacy installations.

Analyst Recommendation

The high severity of this flaw necessitates immediate attention from IT infrastructure teams. We recommend applying the vendor's security updates without delay to prevent the exposure of critical asset management data.

---METADATA---
VENDOR: Victor CMS
PRODUCT: Victor CMS
AFFECTED_VERSIONS: Version 1; See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Victor CMS version 1 is susceptible to a high-severity security flaw that could allow an attacker to gain unauthorized control over the application.

Executive Summary:
Victor CMS version 1 is vulnerable to a high-risk exploit that could lead to full system compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2020-37076

Affected Software: Victor CMS Victor CMS

Affected Versions: Version 1

Vulnerability: This vulnerability affects the initial version of Victor CMS. While the specific function is not detailed, the High severity CVSS score suggests an unauthenticated attacker could potentially exploit the application’s request handling to perform unauthorized actions or access restricted data.

Business Impact

Successful exploitation could result in the total loss of confidentiality and integrity for the hosted website. This includes the potential for site defacement, administrative account takeover, and the exposure of sensitive user databases. The CVSS score of 8.2 justifies a high-priority response from IT security teams.

Remediation Plan

Immediate Action: Apply all available security updates for Victor CMS version 1 or migrate to a more modern, secured content management framework.

Proactive Monitoring: Monitor for unexpected changes to core application files and audit user account creation logs for unauthorized administrative entries.

Compensating Controls: Ensure the web server is running with least-privilege permissions and implement robust input filtering via a WAF.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. As a late-disclosed 2020 vulnerability, users should assume that scanning for this flaw may increase following the formal advisory.

Analyst Recommendation

We recommend an immediate assessment of all Victor CMS installations. Given the High severity rating, the primary remediation—updating the software—should be completed during the next available maintenance window to ensure the security of the environment.

---METADATA---
VENDOR: LanSend
PRODUCT: LanSend
AFFECTED_VERSIONS: 3.2
---END_METADATA---

Description Summary:
LanSend 3.2 contains a buffer overflow in its file import functionality, allowing remote attackers to execute arbitrary code through a crafted payload file that triggers an SEH overwrite.

Executive Summary:
LanSend 3.2 is susceptible to a critical buffer overflow vulnerability that enables Remote Code Execution (RCE) when a malicious file is processed during a computer import operation.

Vulnerability Details

CVE-ID: CVE-2020-37075

Affected Software: LanSend

Affected Versions: 3.2

Vulnerability: The vulnerability is located in the "Add Computers Wizard" file import feature. An attacker can craft a malicious file that, when imported by a user, overwrites the Structured Exception Handler (SEH) and executes arbitrary shellcode on the system.

Business Impact

The CVSS score of 9.8 indicates a critical risk level. Successful exploitation allows an attacker to take complete control of the local system. In a corporate environment, this could lead to the compromise of administrative accounts and subsequent lateral movement across the network, as LanSend is typically used for network administration.

Remediation Plan

Immediate Action: Update LanSend to the latest version immediately. Discontinue the use of the file import feature until the software has been patched.

Proactive Monitoring: Review endpoint security logs for any suspicious activity triggered by the LanSend process, particularly during administrative tasks.

Compensating Controls: Utilize application whitelisting and ensure that administrative tools are run in a restricted environment with limited privileges whenever possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. Like CVE-2020-37074, this is a client-side vulnerability that relies on user interaction with a malicious file.

Analyst Recommendation

The most effective mitigation is applying the vendor's patch. Organizations should also enforce strict policies regarding the source of administrative data files and consider using sandboxed environments for performing bulk import operations to contain potential exploits.

---METADATA---
VENDOR: Remote Desktop Software
PRODUCT: Remote Desktop Audit
AFFECTED_VERSIONS: 2.3.0.157
---END_METADATA---

Description Summary:
Remote Desktop Audit 2.3.0.157 is vulnerable to a buffer overflow during the file import process, allowing attackers to execute arbitrary code via a malicious payload file.

Executive Summary:
A critical buffer overflow in Remote Desktop Audit allows attackers to achieve Remote Code Execution (RCE) by tricking a user into importing a malicious computer list file.

Vulnerability Details

CVE-ID: CVE-2020-37074

Affected Software: Remote Desktop Audit

Affected Versions: 2.3.0.157

Vulnerability: The "Add Computers Wizard" fails to properly handle large or malformed inputs when importing files. By crafting a malicious file, an attacker can trigger a buffer overflow and bypass Structured Exception Handling (SEH) to execute arbitrary shellcode.

Business Impact

With a CVSS score of 9.8, this flaw represents a significant threat to administrative workstations. An attacker can gain full control over the machine used to manage remote desktop connections, potentially compromising the credentials and access to the entire server fleet managed through the software.

Remediation Plan

Immediate Action: Update Remote Desktop Audit to the latest available version and refrain from importing computer lists from untrusted or unknown sources.

Proactive Monitoring: Monitor administrative workstations for unusual process spawning (e.g., cmd.exe or powershell.exe) originating from the Remote Desktop Audit application.

Compensating Controls: Enable advanced exploit protection features like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) at the OS level to mitigate buffer overflow impacts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. This vulnerability requires a user to perform an action (importing a file), which categorizes it as a client-side attack vector.

Analyst Recommendation

Apply the software update immediately to resolve the underlying memory handling issue. Furthermore, security awareness training should emphasize the danger of importing configuration files from untrusted sources, as this is a common vector for targeting IT administrators.

---METADATA---
VENDOR: Victor
PRODUCT: Victor CMS
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Victor CMS 1 is affected by a critical vulnerability that could allow for unauthorized file manipulation or system takeover.

Executive Summary:
Victor CMS 1 contains a critical vulnerability that could allow an unauthenticated attacker to compromise the integrity of the server and its hosted content.

Vulnerability Details

CVE-ID: CVE-2020-37073

Affected Software: Victor Victor CMS

Affected Versions: See vendor advisory for affected versions

Vulnerability: This critical vulnerability affects Victor CMS version 1. The CVSS score of 8.8 indicates a high-impact flaw, likely involving the ability to upload or modify files on the server without proper authentication or authorization.

Business Impact

A successful exploit could lead to the complete takeover of the CMS, allowing an attacker to steal data, host malicious content, or destroy the site's database. The 8.8 CVSS score highlights the extreme risk to the business, as it suggests the vulnerability is easily exploitable and results in total system compromise.

Remediation Plan

Immediate Action: Administrators must immediately apply any available security updates or migrate away from Victor CMS 1 to a more secure and actively maintained platform.

Proactive Monitoring: Monitor for unauthorized file changes and audit all administrative account activity for signs of compromise.

Compensating Controls: Use a WAF to block malicious traffic and implement file integrity monitoring (FIM) to alert on any unauthorized changes to the web root.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late disclosure suggests that organizations may have been at risk for years, making immediate remediation vital.

Analyst Recommendation

This vulnerability poses a critical threat to your web infrastructure. You must apply the primary remediation steps immediately to prevent a full system compromise and protect the organization's digital assets.

---METADATA---
VENDOR: Victor
PRODUCT: Victor CMS
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Victor CMS 1 is vulnerable to a security flaw that could allow for unauthorized content manipulation or system access.

Executive Summary:
Victor CMS 1 contains a high-severity vulnerability that could allow an attacker to gain unauthorized access to the content management system and its hosted data.

Vulnerability Details

CVE-ID: CVE-2020-37072

Affected Software: Victor Victor CMS

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects Victor CMS version 1. The CVSS score of 7.2 suggests a high-impact flaw, likely involving an unauthenticated attacker's ability to bypass access controls or execute unauthorized code within the CMS environment.

Business Impact

A successful exploit could result in the total defacement of the website, the theft of user data, or the use of the server as a pivot point for further attacks. This poses a significant risk to the organization's public reputation and the integrity of the information presented on its web platforms.

Remediation Plan

Immediate Action: Organizations using Victor CMS 1 should immediately apply any available security patches or migrate to a supported, secure version of the software.

Proactive Monitoring: Monitor web server logs for suspicious POST requests or attempts to access administrative directories (e.g., /admin).

Compensating Controls: Implement a Web Application Firewall (WAF) to block common CMS attack patterns, such as SQL injection or cross-site scripting, which may be leveraged here.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure, meaning the vulnerability has existed for some time, increasing the likelihood that automated scanners may already be looking for it.

Analyst Recommendation

The immediate application of vendor-provided patches is essential. Given the high severity and the potential for website compromise, security teams should prioritize this update to protect their external-facing web infrastructure.

---METADATA---
VENDOR: CraftCMS
PRODUCT: vCard Plugin
AFFECTED_VERSIONS: 1.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The CraftCMS vCard Plugin 1.0.0 is vulnerable to unauthenticated remote code execution via a deserialization flaw in the vCard download functionality.

Executive Summary:
An unauthenticated remote code execution vulnerability in the CraftCMS vCard Plugin 1.0.0 allows attackers to execute arbitrary PHP code via crafted serialized payloads.

Vulnerability Details

CVE-ID: CVE-2020-37071

Affected Software: CraftCMS vCard Plugin

Affected Versions: 1.0.0

Vulnerability: This is a deserialization of untrusted data vulnerability (CWE-502) that allows unauthenticated attackers to trigger remote code execution by sending a specially crafted request to the plugin's vCard download endpoint.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary code on the underlying server, leading to a complete compromise of the CMS and potentially the entire host environment. With a CVSS score of 9.8, this vulnerability poses a critical threat to the confidentiality and integrity of the application.

Remediation Plan

Immediate Action: Users should immediately uninstall or disable the vCard plugin if it is not business-critical until a verified security patch is released by the developer.

Proactive Monitoring: Inspect web access logs for requests to vCard download endpoints containing serialized PHP objects or suspicious character sequences.

Compensating Controls: Implement WAF rules to inspect and block incoming HTTP requests that contain serialized PHP structures (e.g., 'O:').

Exploitation Status

Public Exploit Available: Yes — a public exploit is available on ExploitDB and documented on GitLab.

Analyst Notes: As of Feb 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation without authentication.

Analyst Recommendation

Due to the critical nature of this remote code execution vulnerability and the presence of publicly available exploit code, immediate removal or restriction of the affected plugin is required. Organizations should treat this as a high-priority incident until the component is removed or patched.

---METADATA---
VENDOR: CloudMe
PRODUCT: CloudMe
AFFECTED_VERSIONS: 1.11.2
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in CloudMe 1.11.2 allows unauthenticated remote attackers to execute arbitrary code by sending crafted packets to port 8888.

Executive Summary:
CloudMe 1.11.2 contains a critical buffer overflow vulnerability that allows unauthenticated remote code execution, posing a severe risk of complete system takeover.

Vulnerability Details

CVE-ID: CVE-2020-37070

Affected Software: CloudMe

Affected Versions: 1.11.2

Vulnerability: A buffer overflow exists in the way the CloudMe service processes incoming network packets on port 8888. An unauthenticated attacker can send a specially crafted payload to overflow the buffer and gain control of the execution flow.

Business Impact

The CVSS score of 9.8 highlights the extreme risk of Remote Code Execution (RCE). Successful exploitation allows an attacker to run arbitrary commands on the host system with the privileges of the CloudMe service, leading to data theft, ransomware deployment, or use of the system as a pivot point for further network attacks.

Remediation Plan

Immediate Action: Update CloudMe to the latest version that includes the fix for this buffer overflow and close port 8888 to the public internet.

Proactive Monitoring: Monitor network traffic for unusual or oversized packets directed at port 8888 and audit system processes for unauthorized activity.

Compensating Controls: Implement an Intrusion Prevention System (IPS) to detect and block buffer overflow signatures and use host-based security tools to monitor for suspicious execution patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. However, buffer overflows in network-facing services are classic targets for high-impact exploits.

Analyst Recommendation

The primary remediation is to apply the vendor's security patch immediately. If an update is not possible, the CloudMe service should be disabled or strictly firewalled to prevent any untrusted network communication with the vulnerable port.

---METADATA---
VENDOR: Konica Minolta
PRODUCT: FTP Utility
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Konica Minolta FTP Utility 1.0 is vulnerable to a buffer overflow in the NLST command, allowing unauthenticated attackers to crash the service or potentially execute unauthorized code.

Executive Summary:
A critical buffer overflow vulnerability in Konica Minolta FTP Utility 1.0 allows for remote code execution, posing a significant risk to system availability and integrity.

Vulnerability Details

CVE-ID: CVE-2020-37069

Affected Software: Konica Minolta FTP Utility

Affected Versions: 1.0

Vulnerability: This is a classic buffer overflow (CWE-120) occurring within the NLST command handler. The vulnerability is remotely exploitable by an unauthenticated attacker who can send an oversized buffer to corrupt system registers.

Business Impact

Successful exploitation of this vulnerability could lead to a complete service disruption or unauthorized code execution on the host server. Given the CVSS score of 9.8, this flaw represents a critical risk, potentially granting an attacker full control over the affected system and facilitating further lateral movement within the network.

Remediation Plan

Immediate Action: Review the Konica Minolta support portal for the latest patch or version upgrade; if no patch is available, disable the service immediately.

Proactive Monitoring: Monitor network traffic for anomalous FTP command sequences and review system logs for signs of service crashes or unauthorized process execution.

Compensating Controls: Deploy a Web Application Firewall or Network Intrusion Prevention System (IPS) with signatures configured to detect and block oversized input buffers directed at FTP services.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry (48502) exists.

Analyst Notes: As of Feb 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ability to be triggered via simple network interaction.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate action. Administrators should prioritize identifying and patching all instances of this utility or removing the software from the environment to eliminate the attack surface.

---METADATA---
VENDOR: Konica Minolta
PRODUCT: FTP Utility
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the LIST command, allowing unauthenticated attackers to cause a crash or execute unauthorized code.

Executive Summary:
A critical buffer overflow in the Konica Minolta FTP Utility 1.0 LIST command permits remote code execution, creating a high-risk security exposure.

Vulnerability Details

CVE-ID: CVE-2020-37068

Affected Software: Konica Minolta FTP Utility

Affected Versions: 1.0

Vulnerability: The application suffers from a buffer overflow (CWE-120) due to inadequate input validation in the LIST command. An unauthenticated attacker can send a malicious, oversized buffer to overwrite system registers, leading to service failure or code execution.

Business Impact

The potential for remote code execution makes this a high-priority threat, as it allows attackers to bypass standard authentication controls. With a CVSS score of 9.8, the business impact includes potential data exfiltration, system compromise, and significant operational downtime if the FTP service is critical to business processes.

Remediation Plan

Immediate Action: Update to the latest version of the utility if available; otherwise, decommission the service if it is not business-critical.

Proactive Monitoring: Analyze FTP traffic logs for unusual patterns or abnormally long command strings that match the identified attack vector.

Compensating Controls: Restrict access to the FTP service using firewalls to allow only known-trusted IP addresses and employ IPS rules to filter traffic for buffer overflow signatures.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry (48501) exists.

Analyst Notes: As of Feb 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication required to trigger the overflow.

Analyst Recommendation

Given the critical nature of this vulnerability and the presence of public exploit code, organizations must treat this as a high-priority remediation item. Patching or removal of the vulnerable software is the only effective way to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Filetto
PRODUCT: Filetto FTP Server
AFFECTED_VERSIONS: Version 1.0
---END_METADATA---

Description Summary:
Filetto 1.0 FTP server contains a denial of service (DoS) vulnerability in the FEAT command processing. Sending an oversized command causes a buffer overflow and service crash.

Executive Summary:
A critical buffer overflow vulnerability in the Filetto FTP Server allows unauthenticated attackers to remotely crash the service, resulting in a persistent denial of service.

Vulnerability Details

CVE-ID: CVE-2020-37067

Affected Software: Filetto FTP Server

Affected Versions: Version 1.0

Vulnerability: The vulnerability occurs during the processing of the FTP "FEAT" command. An unauthenticated attacker can send a specially crafted FEAT command containing 11,008 bytes of repeated characters, which triggers a buffer overflow and causes the FTP service to terminate unexpectedly.

Business Impact

Successful exploitation results in the immediate unavailability of the FTP service, disrupting file transfer operations and potentially impacting business workflows that rely on the server. While primarily a Denial of Service, the CVSS score of 9.8 suggests that the underlying memory corruption could potentially be leveraged for more advanced exploitation.

Remediation Plan

Immediate Action: Update Filetto FTP Server to the latest version or migrate to a more robust and regularly maintained FTP solution such as FileZilla Server or an SFTP-based alternative.

Proactive Monitoring: Configure automated alerts to notify administrators if the FTP service stops unexpectedly and monitor network traffic for unusually large FTP command strings.

Compensating Controls: Implement an Intrusion Prevention System (IPS) with signatures designed to detect and drop oversized or malformed FTP commands, specifically targeting the FEAT verb.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. DoS vulnerabilities in FTP servers are frequently used as a precursor to broader attacks or to disrupt defensive operations.

Analyst Recommendation

The Filetto FTP Server version 1.0 is highly susceptible to remote disruption. Given the age of the software and the criticality of the flaw, it is recommended to replace this software with a modern, secure alternative that supports encrypted transfers and has a proven track record of security patching.

---METADATA---
VENDOR: GoldWave
PRODUCT: GoldWave
AFFECTED_VERSIONS: Version 5.70
---END_METADATA---

Description Summary:
GoldWave 5.70 is vulnerable to a stack-based buffer overflow in the File Open URL dialog. Attackers can use Unicode-encoded shellcode in a text file to execute commands upon opening.

Executive Summary:
A critical stack-based buffer overflow in GoldWave 5.70 enables attackers to execute arbitrary code on a user's system by tricking them into opening a specially crafted URL or file.

Vulnerability Details

CVE-ID: CVE-2020-37066

Affected Software: GoldWave

Affected Versions: Version 5.70

Vulnerability: The vulnerability exists in the "File Open URL" dialog handler. By crafting a malicious text file containing Unicode-encoded shellcode and a long string, an attacker can trigger a stack-based overflow when the user attempts to open the malicious input, leading to arbitrary command execution.

Business Impact

Successful exploitation results in arbitrary code execution with the privileges of the logged-in user. This could lead to unauthorized access to sensitive files, credential theft, and the establishment of a persistent presence on the corporate network. The CVSS score of 9.8 underscores the high severity of this remote exploitation vector.

Remediation Plan

Immediate Action: Update GoldWave to the latest version immediately. Users should be cautioned against opening suspicious URLs or files from untrusted sources within the application.

Proactive Monitoring: Review system logs for suspicious child processes spawned by GoldWave.exe and monitor for unauthorized network activity following file-open operations.

Compensating Controls: Utilize application whitelisting and ensure that "Open URL" features are restricted or monitored by host-based security software.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the requirement for user interaction (opening a file/URL) is a common social engineering tactic used in targeted attacks.

Analyst Recommendation

The ability to execute code via a standard file-open dialog is a critical security failure. Organizations must ensure that GoldWave is updated to a patched version across all endpoints. Furthermore, security awareness training should emphasize the risks of processing untrusted files in multimedia software.

---METADATA---
VENDOR: StreamRipper32
PRODUCT: StreamRipper32
AFFECTED_VERSIONS: Version 2.6
---END_METADATA---

Description Summary:
StreamRipper32 version 2.6 contains a buffer overflow in the Station/Song Section. Attackers can provide a malicious SongPattern input to overwrite memory and execute arbitrary code.

Executive Summary:
A critical buffer overflow vulnerability in StreamRipper32 allows unauthenticated attackers to execute arbitrary code and gain full control over the host system via crafted song patterns.

Vulnerability Details

CVE-ID: CVE-2020-37065

Affected Software: StreamRipper32

Affected Versions: Version 2.6

Vulnerability: This is a classic buffer overflow vulnerability residing in the Station/Song Section. An unauthenticated attacker can craft a malicious payload exceeding 256 bytes in the SongPattern input, triggering a memory overwrite that allows for arbitrary code execution.

Business Impact

A successful exploit grants the attacker the same privileges as the user running the StreamRipper32 application. This can lead to full system compromise, including the installation of malware, data exfiltration, and lateral movement within the network. The CVSS score of 9.8 reflects the critical nature of remote code execution (RCE) vulnerabilities.

Remediation Plan

Immediate Action: Discontinue the use of StreamRipper32 version 2.6 and update to the latest available version or an alternative secure streaming utility.

Proactive Monitoring: Security teams should monitor for unusual process behavior originating from the StreamRipper32 executable, such as unexpected network connections or shell spawning.

Compensating Controls: Implement Endpoint Detection and Response (EDR) solutions to detect and block memory exploitation attempts and buffer overflow techniques at the host level.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. Buffer overflows in legacy media applications are common targets for exploit researchers, making the potential for exploitation high.

Analyst Recommendation

Organizations should immediately identify and update or remove any instances of StreamRipper32 2.6 within their environment. Because this vulnerability allows for unauthenticated remote code execution, it represents a significant risk to any workstation where the software is deployed.

---METADATA---
VENDOR: EPSON
PRODUCT: EasyMP Network Projection 2
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
EPSON EasyMP Network Projection 2 contains a vulnerability that could lead to unauthorized system access or service disruption during network projection sessions.

Executive Summary:
A vulnerability in EPSON EasyMP Network Projection 2 poses a high risk to systems utilizing network-based projection, potentially allowing for unauthorized remote interference.

Vulnerability Details

CVE-ID: CVE-2020-37064

Affected Software: EPSON EasyMP Network Projection 2

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists within the EPSON EasyMP Network Projection 2 software, which facilitates screen sharing over a network. While the specific mechanism is not detailed, such software often suffers from improper input validation or insecure session handling, which an attacker could exploit to disrupt presentations or potentially execute code.

Business Impact

Successful exploitation could allow an attacker to hijack active projection sessions, leading to the exposure of sensitive information during meetings or corporate events. A CVSS score of 7.8 indicates a High severity, reflecting a significant risk to confidentiality and integrity. Beyond information leakage, this flaw could be used as an entry point into the user's workstation, jeopardizing the security of the broader corporate network.

Remediation Plan

Immediate Action: Apply the latest security patches or software updates provided by EPSON for the EasyMP Network Projection 2 application.

Proactive Monitoring: Review network logs for unusual traffic on ports associated with EPSON projection services and monitor endpoint security alerts for suspicious process behavior.

Compensating Controls: Use encrypted projection methods where possible and ensure that projection software is only run on secured, authenticated network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, projection software is a high-value target for industrial espionage and corporate disruption.

Analyst Recommendation

We recommend that all users of EPSON EasyMP Network Projection 2 update their software immediately to the latest version. IT departments should audit all presentation room hardware and associated laptops to ensure compliance. Immediate patching is the only effective way to mitigate the risk associated with this High-severity vulnerability.

---METADATA---
VENDOR: TFTP Turbo
PRODUCT: TFTP Turbo 4
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
TFTP Turbo 4 is affected by a security vulnerability that may compromise the integrity of file transfers or service availability. High-severity risk requires immediate administrative attention.

Executive Summary:
A high-severity vulnerability in TFTP Turbo 4 could allow attackers to disrupt file transfer services or gain unauthorized access to sensitive system data.

Vulnerability Details

CVE-ID: CVE-2020-37063

Affected Software: TFTP Turbo 4

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides in the TFTP Turbo 4 service, a protocol frequently used for automated configuration and booting. The flaw likely involves a failure to properly validate incoming requests, which could be leveraged by an attacker to cause a service failure or manipulate file operations.

Business Impact

The compromise of a TFTP server can lead to the distribution of malicious firmware or configuration files to networked devices, such as VoIP phones or routers. With a CVSS score of 7.8, this High-severity flaw threatens the integrity of the automated provisioning process. Successful exploitation could result in unauthorized data exfiltration or a complete halt of deployment workflows, causing substantial reputational and operational damage.

Remediation Plan

Immediate Action: Update TFTP Turbo 4 to the most recent version available from the vendor to close the identified security gap.

Proactive Monitoring: Enable detailed logging for all TFTP transactions and monitor for unexpected file requests or source IP addresses that do not match known provisioning clients.

Compensating Controls: Implement strict firewall rules to ensure the TFTP service is only reachable by necessary endpoints and use a Web Application Firewall (WAF) or IPS where applicable to filter malicious traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the inherent lack of authentication in the TFTP protocol, vulnerabilities in its implementation are particularly dangerous and attractive to attackers.

Analyst Recommendation

Given the critical role TFTP plays in device management, this vulnerability should be remediated within the current maintenance cycle. We strongly recommend applying the vendor's security updates immediately. In the interim, ensure the service is isolated from the public internet and restricted to trusted internal segments.

---METADATA---
VENDOR: DHCP Turbo
PRODUCT: DHCP Turbo 4
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in DHCP Turbo 4 that could allow for unauthorized actions or service disruption. Precise technical details are limited, necessitating immediate vendor consultation.

Executive Summary:
DHCP Turbo 4 contains a high-severity vulnerability that poses a significant risk to network infrastructure stability and security.

Vulnerability Details

CVE-ID: CVE-2020-37062

Affected Software: DHCP Turbo 4

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects DHCP Turbo 4, a critical network service component. Based on the CVSS score and product type, the flaw likely involves improper handling of network packets or configuration files, potentially allowing an attacker to impact service availability.

Business Impact

A successful exploit of this vulnerability could lead to significant network downtime or unauthorized modification of DHCP configurations. Given the CVSS score of 7.8, the severity is High; an attacker could potentially disrupt IP address assignment across the enterprise, leading to widespread connectivity issues and operational paralysis. The resulting loss of productivity and potential for secondary attacks on unmanaged network segments represents a critical business risk.

Remediation Plan

Immediate Action: Administrators should apply the latest security updates provided by the vendor immediately to mitigate the risk of exploitation.

Proactive Monitoring: Monitor DHCP server logs for unusual request patterns, frequent service restarts, or unauthorized configuration changes.

Compensating Controls: Restrict access to the DHCP management interface to authorized administrative subnets and implement network segmentation to limit the blast radius of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, because DHCP services are foundational to network operations, the potential impact of an exploit is extremely high, and discovery by malicious actors is a constant threat.

Analyst Recommendation

The high CVSS score of 7.8 underscores the necessity of treating this vulnerability with high priority. Organizations relying on DHCP Turbo 4 must verify their current version and apply vendor-supplied patches immediately. Failure to secure this service could leave the entire network infrastructure vulnerable to denial-of-service or redirection attacks.

Executive Summary:
A high-severity vulnerability has been identified in BOOTP Turbo 2, affecting multiple products. An unauthenticated attacker on the local network could exploit this flaw to potentially execute arbitrary code on the affected server, leading to a complete system compromise and disruption of critical network services. Organizations are urged to apply vendor patches immediately to mitigate the significant risk of unauthorized access and network instability.

Vulnerability Details

CVE-ID: CVE-2020-37061

Affected Software: BOOTP Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a buffer overflow within the BOOTP Turbo 2 service. The flaw occurs when the service improperly handles specially crafted BOOTP request packets. An unauthenticated attacker on the same network segment can send a malicious packet with an oversized payload, triggering the overflow and allowing for the execution of arbitrary code with the privileges of the BOOTP service. Successful exploitation does not require any user interaction or prior authentication.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. Successful exploitation could lead to a complete compromise of the server running the BOOTP service. An attacker could gain a foothold in the network, install malware or ransomware, exfiltrate sensitive data, or pivot to attack other internal systems. Furthermore, since BOOTP is a foundational network service responsible for assigning IP addresses, its compromise could lead to a widespread denial-of-service condition, disrupting business operations that rely on network connectivity.

Remediation Plan

Immediate Action:

• Apply vendor security updates immediately to all affected systems to patch the vulnerability.
• After patching, monitor for any signs of exploitation attempts that may have occurred prior to remediation.
• Review system and network access logs for any anomalous activity originating from or targeting the BOOTP server.

Proactive Monitoring:

• Network Traffic: Utilize network intrusion detection/prevention systems (NIDS/NIPS) to monitor for malformed or unusually large BOOTP (UDP port 67) packets.
• Log Analysis: Scrutinize BOOTP server logs for repeated crashes, restarts, or error messages related to packet processing, which could indicate scanning or exploitation attempts.
• Host-Based Monitoring: Monitor the server for unexpected processes, unauthorized outbound network connections, or abnormal CPU and memory utilization.

Compensating Controls:

• Network Segmentation: Isolate the BOOTP server from critical assets and user workstations.
• Access Control: Implement strict firewall rules or Access Control Lists (ACLs) to restrict BOOTP traffic to only trusted network segments and authorized clients.
• Intrusion Prevention System (IPS): Deploy an IPS with updated signatures capable of detecting and blocking known exploit patterns for buffer overflow vulnerabilities in network services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 2, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the low complexity of exploitation for a network-based service, the likelihood of an exploit being developed is high. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high severity (CVSS 7.8) of this vulnerability and its potential for complete system compromise, we strongly recommend that patching be treated as a critical priority. Organizations should apply the vendor-provided security updates to all affected BOOTP servers immediately. While there is no current evidence of active exploitation, the risk of future attacks is significant. If immediate patching is not feasible, implement the recommended compensating controls, particularly network segmentation and access control, to reduce the attack surface until updates can be deployed.

Executive Summary:
A high-severity vulnerability exists within the feedback module of multiple Online Exam System products, allowing for a SQL injection attack. An unauthenticated attacker can exploit this flaw to manipulate the application's database, potentially leading to the unauthorized access, modification, or theft of sensitive information such as student data, exam results, and administrative credentials.

Vulnerability Details

CVE-ID: CVE-2020-37057

Affected Software: Multiple Products utilizing the 'feedback module', including Online-Exam-System 2015.

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The application's feedback module contains a SQL injection vulnerability due to insufficient input sanitization of the 'fid' parameter. An attacker can send a specially crafted request containing malicious SQL commands within the 'fid' parameter. Because the application incorporates this user-supplied data directly into a database query, the attacker's commands are executed by the database, allowing them to bypass security controls and interact directly with the underlying database.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2, posing a significant risk to the organization. Successful exploitation could lead to a severe data breach, compromising the confidentiality, integrity, and availability of the system. For an online exam platform, this could result in the theft of student personal information, alteration of grades, leakage of confidential exam questions, and reputational damage to the institution. The compromise of administrative credentials could allow an attacker to gain full control over the system, leading to widespread disruption.

Remediation Plan

Immediate Action:

• Apply Patches: Immediately deploy the security patches provided by the vendor to fix the root cause of the vulnerability.
• Review Access Controls: Audit the database user account used by the application. Ensure it operates under the principle of least privilege, with permissions restricted only to the necessary database operations.
• Enable Logging: Activate and monitor detailed database query logging. This will help in detecting potential exploitation attempts and aid in forensic analysis if a compromise is suspected.

Proactive Monitoring:

• Monitor web server and application logs for unusual requests targeting the feedback module, specifically looking for malformed or suspicious syntax in the 'fid' parameter.
• Analyze database logs for unexpected queries, errors, or queries that deviate from normal application behavior.
• Use a Web Application Firewall (WAF) to monitor and block traffic matching known SQL injection signatures.

Compensating Controls:

• Web Application Firewall (WAF): If patching is delayed, implement or configure a WAF with strict rules to detect and block SQL injection attack patterns against the 'fid' parameter.
• Input Validation: As a temporary measure, implement server-side validation to strictly sanitize and validate all data passed through the 'fid' parameter, allowing only expected data types and formats.
• Database Segmentation: Isolate the database server on a secure network segment to limit an attacker's ability to move laterally if the database is compromised.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of January 31, 2026, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, SQL injection is a well-documented and common vulnerability class, and proof-of-concept exploits are readily available for such flaws. Threat actors frequently scan for and exploit unpatched SQL injection vulnerabilities, making any unpatched, internet-facing system a likely target.

Analyst Recommendation
Given the High severity (CVSS 8.2) of this vulnerability and the critical nature of the data managed by an Online Exam System, immediate action is required. Although this CVE is not on the CISA KEV list, the ease of exploitation and potential for significant data compromise present a clear and present danger. We strongly recommend that organizations prioritize the immediate application of vendor patches. If patching is not feasible, the compensating controls outlined above, particularly the use of a WAF, should be implemented without delay to mitigate risk.

Executive Summary:
A critical IP spoofing vulnerability exists in Crystal Shard's http-protection middleware, identified as CVE-2020-37056. This flaw allows a remote attacker to bypass IP-based security controls, such as access lists or rate limiting, by manipulating specific HTTP headers. Successful exploitation could lead to unauthorized access to protected resources, denial-of-service conditions, or circumvention of security policies.

Vulnerability Details

CVE-ID: CVE-2020-37056

Affected Software: Crystal Shard Multiple Products

Affected Versions: http-protection version 0.2.0. See vendor advisory for specific affected products.

Vulnerability: The http-protection middleware fails to properly validate the source of IP address information, incorrectly trusting user-supplied HTTP headers. An unauthenticated, remote attacker can exploit this by sending a crafted HTTP request containing headers such as X-Forwarded-For, X-Client-IP, and X-Real-IP. By setting a consistent, arbitrary IP address value across these headers, the attacker can deceive the application into believing the request originates from a trusted or whitelisted IP, thereby bypassing security middleware designed to restrict access based on the source IP address.

Business Impact

This vulnerability is rated as critical with a CVSS score of 9.8, posing a severe risk to the organization. Exploitation could lead to a complete compromise of IP-based access controls, resulting in unauthorized access to sensitive applications, data, and administrative interfaces. This could facilitate data breaches, account takeovers, and further network intrusion. Additionally, bypassing rate-limiting protections could expose services to denial-of-service (DoS) attacks, impacting service availability and business continuity.

Remediation Plan

Immediate Action:

• Immediately apply security updates by upgrading all instances of Crystal Shard Multiple Products to the latest patched version as recommended by the vendor.
• Review access logs for any signs of past exploitation, such as successful logins or access from unexpected IP addresses that may have been spoofed.

Proactive Monitoring:

• Implement log monitoring rules to detect and alert on incoming web requests that contain multiple IP-forwarding headers (X-Forwarded-For, X-Client-IP, X-Real-IP).
• Analyze web server and application logs for anomalous access patterns, such as a high volume of requests from a single IP that is not a known proxy, or access attempts that bypass established IP blocklists.

Compensating Controls:

• If immediate patching is not feasible, configure upstream devices like load balancers or reverse proxies to strip these specific headers from client-initiated requests and set a trusted value before forwarding traffic to the application.
• Deploy a Web Application Firewall (WAF) with rules designed to detect and block requests with manipulated or conflicting IP-forwarding headers.
• Enforce multi-factor authentication (MFA) on all critical systems to provide an additional layer of security that does not rely on the source IP address.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of January 30, 2026, this vulnerability has been publicly disclosed. Given the straightforward nature of the exploit (header manipulation), it is highly likely that threat actors can easily craft exploits. Although not currently listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, its high severity and ease of exploitation make it an attractive target.

Analyst Recommendation

Given the critical CVSS score of 9.8, this vulnerability requires immediate attention. The primary recommendation is to apply the vendor-supplied patches across all affected systems without delay. If patching must be postponed, the implementation of compensating controls, particularly reconfiguring the upstream reverse proxy to sanitize IP-related headers, is a critical stop-gap measure to mitigate the immediate risk of unauthorized access. Organizations should treat this as a high-priority vulnerability due to the significant potential for security control bypass.

Executive Summary:
A high-severity vulnerability exists in SpyHunter security products that could allow a local attacker to take full control of an affected system. The flaw, known as an unquoted service path, can be exploited by a malicious user with standard access to run their own code with the highest system privileges. This would allow an attacker to completely compromise the machine, steal data, and potentially move to other systems on the network.

Vulnerability Details

CVE-ID: CVE-2020-37055

Affected Software: SpyHunter Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an Unquoted Service Path. The SpyHunter service executable's path is registered in Windows without being enclosed in quotation marks. If the path contains spaces (e.g., C:\Program Files\SpyHunter\service.exe), the Windows operating system may misinterpret it and attempt to execute files at each space-separated segment. An attacker with local access and permissions to write to a parent directory (like C:\) can place a malicious executable named Program.exe in that location. When the system attempts to start the SpyHunter service, it will execute the attacker's malicious file with SYSTEM-level privileges instead of the legitimate service.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. Exploitation allows for a full privilege escalation, enabling an attacker with basic user access to gain complete administrative (SYSTEM) control over the affected endpoint. The business impact includes the potential for total system compromise, leading to data theft of sensitive corporate or personal information, deployment of ransomware or other persistent malware, and the ability for an attacker to use the compromised machine as a pivot point to attack other resources on the internal network. Since SpyHunter is a security product, its compromise could also be used to disable other security controls and evade detection.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor to all affected systems immediately. After patching, monitor system logs for any signs of pre-patch exploitation, such as unexpected service failures or unauthorized process execution. Review access logs to identify any accounts that may have been used to exploit this vulnerability.

Proactive Monitoring: Monitor Windows Event Logs (System and Security) for unusual service behavior, particularly Event ID 7000 (Service Start Failed) related to the SpyHunter service. Enable and monitor process creation logging (Event ID 4688) to detect suspicious executables (e.g., Program.exe, Common.exe) launching from root directories like C:\ or C:\Program Files.

Compensating Controls: If patching cannot be performed immediately, implement application control solutions like AppLocker or Windows Defender Application Control to prevent the execution of unauthorized executables from world-writable directories. Additionally, enforce strict file system permissions to prevent non-administrative users from creating files in root-level directories.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of February 2, 2026, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the technique for exploiting unquoted service paths is publicly known, well-documented, and trivial for an attacker with local access to execute. Privilege escalation is a common objective for threat actors after gaining an initial foothold, making vulnerabilities like this an attractive target.

Analyst Recommendation

Given the high severity (CVSS 7.8) and the simplicity of exploitation for an attacker who has already gained local access, we recommend that organizations prioritize patching this vulnerability immediately. Although it is not on the CISA KEV list, the risk of complete system compromise is significant. All endpoints running the affected SpyHunter products should be identified and updated to the latest version to mitigate the risk of privilege escalation and subsequent lateral movement within the network.

Executive Summary:
A critical vulnerability has been identified in AirControl products, designated CVE-2020-37052. This flaw allows an unauthenticated remote attacker to take complete control of the affected system by sending a specially crafted web request. Successful exploitation could lead to a full system compromise, data theft, and significant operational disruption.

Vulnerability Details

CVE-ID: CVE-2020-37052

Affected Software: AirControl Multiple Products

Affected Versions: Version 1.4.2 is confirmed vulnerable. See vendor advisory for a complete list of affected versions.

Vulnerability: This is a pre-authentication remote code execution (RCE) vulnerability. The flaw exists within the application's handling of the /.seam endpoint, which is vulnerable to Java expression injection. An unauthenticated attacker can craft a malicious URL containing Java expressions that, when processed by the server, are executed as system commands with the privileges of the AirControl application service.

Business Impact

This vulnerability carries a critical severity rating with a CVSS score of 9.8. Exploitation requires no authentication or user interaction, making it easy to automate and use for widespread attacks. A successful attack would result in a complete compromise of the server hosting the AirControl software, allowing an attacker to steal sensitive data, install malware or ransomware, disrupt services, and use the compromised system as a pivot point to move laterally within the corporate network. The potential business impact includes major data breaches, significant operational downtime, financial loss, and severe reputational damage.

Remediation Plan

Immediate Action:

• Immediately update all instances of AirControl to the latest patched version as recommended by the vendor.
• Consult the official vendor security advisory for specific patch information and detailed instructions.
• After patching, review web server and application logs for any signs of past exploitation attempts targeting the /.seam endpoint.

Proactive Monitoring:

• Monitor web server access logs for any requests to the /.seam endpoint. Pay close attention to requests with unusually long or complex URL parameters, as these may indicate exploitation attempts.
• Implement endpoint monitoring to detect suspicious processes being spawned by the AirControl application user.
• Monitor network traffic for unexpected outbound connections from the AirControl server, which could signify a successful compromise.

Compensating Controls:

• If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to block all access to the /.seam endpoint or filter requests containing patterns associated with Java expression injection.
• Restrict network access to the AirControl management interface to only trusted IP addresses and internal management networks.
• Run the AirControl service with the lowest possible user privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: true

Analyst Notes:
As of January 30, 2026, this is a critical pre-authentication RCE vulnerability that is simple to exploit. Vulnerabilities of this nature typically see rapid development of public proof-of-concept (PoC) exploits, and widespread scanning for vulnerable instances is highly likely. Although the CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its high severity and low attack complexity mean it is a prime target for threat actors. Organizations should assume active exploitation is occurring in the wild.

Analyst Recommendation
Given the critical CVSS score of 9.8 and the pre-authentication nature of this RCE vulnerability, we strongly recommend that immediate action be taken. The primary and most effective remediation is to apply the vendor-supplied patches to all affected AirControl systems without delay. If patching is not immediately possible, the compensating controls listed above, particularly restricting access and implementing WAF rules, must be deployed as a matter of urgency to reduce the attack surface. Furthermore, organizations should actively hunt for evidence of compromise, as systems may have been breached prior to the application of patches.

Executive Summary:
A high-severity vulnerability exists within the feedback form of the Online-Exam-System and potentially other products. This flaw, a time-based blind SQL injection, allows an unauthenticated attacker to manipulate the database and steal sensitive information, such as user password hashes. Successful exploitation could lead to a complete compromise of the application's database, resulting in a significant data breach.

Vulnerability Details

CVE-ID: CVE-2020-37051

Affected Software: feedback Multiple Products, including Online-Exam-System

Affected Versions: The 2015 version of Online-Exam-System is explicitly mentioned. See vendor advisory for a complete list of affected products and versions.

Vulnerability: The application's feedback form fails to properly sanitize user-supplied input before incorporating it into a database query. An attacker can submit specially crafted input containing malicious SQL commands. Because this is a "blind" SQL injection, the application does not directly return data or errors; instead, the attacker uses time-based commands (e.g., SLEEP() or WAITFOR DELAY) to force the database to pause for a specific duration based on true/false conditions. By measuring the server's response time, the attacker can infer information one character at a time, allowing for the methodical exfiltration of the entire database, including sensitive password hashes.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. Exploitation could lead to a complete compromise of the underlying database, exposing all stored data. The primary business impact is a severe data breach, including the theft of user credentials (password hashes), which could grant attackers access to user accounts. This can result in significant reputational damage, loss of customer trust, and potential financial and legal repercussions related to data privacy regulations.

Remediation Plan

Immediate Action:

• Apply Patches: Immediately deploy the security patches provided by the vendor to fix the root cause of the vulnerability.
• Review Access Controls: Audit database user permissions to ensure the web application's account adheres to the principle of least privilege, limiting the potential impact of a compromise.
• Enable Logging: Activate and monitor detailed database query logging to detect and investigate suspicious queries indicative of an attack.

Proactive Monitoring:

• Monitor web application logs for unusually long response times or malformed requests targeting the feedback form.
• Analyze database logs for queries containing time-delay functions (e.g., SLEEP, BENCHMARK, WAITFOR DELAY) or other common SQL injection payloads.
• Utilize network monitoring to flag connections with abnormally high latency patterns, which could indicate a time-based exfiltration attempt.

Compensating Controls:

• Implement a Web Application Firewall (WAF) with a ruleset configured to detect and block SQL injection attacks.
• If possible, enforce strict input validation and parameterization at the application layer as an interim measure until patching can be completed.
• Restrict access to the feedback form to authenticated users only to reduce the attack surface from unauthenticated attackers.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of January 31, 2026, proof-of-concept exploits and automated tools for time-based blind SQL injection are widely available, making this vulnerability relatively easy for attackers to exploit. While this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, the high severity and availability of public exploits present a significant risk.

Analyst Recommendation
Given the high CVSS score of 8.2 and the potential for a complete database compromise, this vulnerability requires immediate attention. The primary recommendation is to apply the vendor-supplied patches across all affected systems without delay. Due to the wide availability of exploitation tools for this vulnerability class, organizations should treat this as a critical priority, even in the absence of a CISA KEV listing.

Executive Summary:
A critical buffer overflow vulnerability has been identified in Quick Player software, rated with a CVSS score of 9.8 out of 10. An attacker can exploit this flaw by tricking a user into opening a specially crafted malicious media file, which could allow the attacker to execute arbitrary code and gain full control of the affected system. This could lead to data theft, installation of malware, or further intrusion into the network.

Vulnerability Details

CVE-ID: CVE-2020-37050

Affected Software: Quick Player Multiple Products

Affected Versions: Version 1.3 is confirmed to be vulnerable. See vendor advisory for a complete list of affected products and versions.

Vulnerability: This vulnerability is a classic buffer overflow that occurs when the Quick Player application processes a specially crafted .m3l media playlist file. An attacker can create a .m3l file with an overly long data string that, when parsed by the application, exceeds the memory buffer allocated for it. This overflow can be leveraged to overwrite adjacent memory, including the instruction pointer, allowing the attacker to redirect the program's execution flow to a malicious payload (shellcode) embedded within the file, resulting in arbitrary code execution with the permissions of the user running the application.

Business Impact

The exploitation of this vulnerability carries a critical business impact, reflected by its CVSS score of 9.8. A successful attack would grant an adversary complete control over the compromised workstation, effectively making them an administrator on the machine. This level of access could lead to severe consequences, including the theft of sensitive corporate or personal data, deployment of ransomware, installation of persistent backdoors for long-term access, and the ability to use the compromised system as a pivot point to attack other resources on the internal network. The potential for data breaches, financial loss, and significant reputational damage is extremely high.

Remediation Plan

Immediate Action: Immediately update all instances of Quick Player Multiple Products to the latest version provided by the vendor to patch this vulnerability. Prioritize patching on systems used by employees with access to sensitive information and on all workstations with the vulnerable software installed. Following the update, monitor for any signs of prior exploitation by reviewing application and system access logs for suspicious activity.

Proactive Monitoring: Implement enhanced monitoring on endpoints where Quick Player is installed. Use Endpoint Detection and Response (EDR) tools to look for suspicious process chains, such as quickplayer.exe spawning command shells (cmd.exe, powershell.exe) or making unusual outbound network connections. Security teams should also monitor for an increase in Quick Player application crashes, as this can be an indicator of failed exploitation attempts.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce risk:

• User Education: Advise all users to be cautious and not open .m3l files from untrusted sources, such as email attachments or internet downloads.
• File Association: Disassociate the .m3l file extension from the Quick Player application to prevent users from accidentally opening a malicious file.
• Application Control: Utilize application whitelisting solutions to prevent Quick Player from executing unexpected child processes.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of the publication date of this advisory (Jan 30, 2026), there are no known public proof-of-concept exploits or observed in-the-wild attacks targeting CVE-2020-37050. However, buffer overflow vulnerabilities in file parsing mechanisms are well-understood, and it is highly probable that a functional exploit could be developed by threat actors with moderate skill. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this vulnerability and the potential for complete system compromise, we strongly recommend that organizations treat this as a high-priority issue. The required user interaction does not significantly diminish the risk, as social engineering tactics are highly effective. All vulnerable instances of Quick Player should be updated to the latest version immediately. Although there is no evidence of active exploitation at this time, the risk of future attacks is substantial, and organizations should act decisively to apply patches or implement mitigating controls without delay.