CVE-2020-37074: Remote Desktop Audit Buffer Overflow Flaw

CVE-2020-37074 Overview

Remote Desktop Audit 2.3.0.157 contains a buffer overflow vulnerability (CWE-120) that allows attackers to execute arbitrary code during the Add Computers Wizard file import process. Attackers can craft a malicious payload file to trigger a structured exception handler (SEH) bypass and execute shellcode when importing computer lists.

Critical Impact

This buffer overflow vulnerability enables arbitrary code execution through SEH bypass, potentially allowing complete system compromise when a user imports a maliciously crafted computer list file.

Affected Products

• Remote Desktop Audit version 2.3.0.157
• Lizard Systems Remote Desktop Audit (vulnerable versions)

Discovery Timeline

• 2026-02-03 - CVE CVE-2020-37074 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2020-37074

Vulnerability Analysis

This vulnerability is classified as a classic buffer overflow (CWE-120: Buffer Copy without Checking Size of Input). The flaw exists in the Add Computers Wizard functionality of Remote Desktop Audit, which processes imported computer list files without proper bounds checking on input data.

When a user imports a computer list file through the wizard, the application fails to validate the length of input data before copying it into a fixed-size buffer. This allows an attacker to overflow the buffer and overwrite adjacent memory, including the Structured Exception Handler (SEH) chain. By crafting a malicious payload file with carefully positioned shellcode and SEH overwrite values, an attacker can hijack program execution flow.

The local attack vector requires user interaction—specifically, the victim must open or import the malicious file. However, the exploitation does not require any privileges, making social engineering attacks viable.

Root Cause

The root cause of this vulnerability is insufficient input validation during the file import process in the Add Computers Wizard. The application copies user-supplied data from the imported file into a stack-based buffer without verifying that the data length does not exceed the allocated buffer size. This lack of bounds checking allows attackers to write beyond buffer boundaries, corrupting stack memory including the SEH chain.

Attack Vector

The attack requires local access and user interaction. An attacker would craft a malicious computer list file containing an oversized payload designed to overflow the target buffer. The payload would include:

1. Padding to reach the SEH overwrite offset
2. A crafted SEH chain pointing to attacker-controlled shellcode
3. The shellcode to execute upon exception handling

When the victim imports this file through the Add Computers Wizard, the buffer overflow triggers, the SEH chain is corrupted, and upon exception, execution is redirected to the attacker's shellcode.

The vulnerability exploitation mechanism involves overwriting the SEH chain with controlled values. When an exception occurs (often triggered intentionally by the overflow itself), Windows walks the SEH chain to find an exception handler. The corrupted chain redirects execution to attacker-supplied code. For detailed technical analysis and proof-of-concept information, refer to Exploit-DB #48465 and the VulnCheck Advisory.

Detection Methods for CVE-2020-37074

Indicators of Compromise

• Unexpected crashes of Remote Desktop Audit application during file import operations
• Presence of unusually large or malformed computer list files (.txt, .csv, or similar import formats) in user directories
• Process execution spawned from rdaudit.exe with anomalous behavior or child processes
• Windows Event Log entries indicating application crashes with exception codes related to access violations

Detection Strategies

• Deploy endpoint detection rules to monitor Remote Desktop Audit (rdaudit.exe) for abnormal memory access patterns or exception handling behavior
• Implement file integrity monitoring for directories where computer list files are commonly stored or downloaded
• Configure application whitelisting to alert on unexpected child processes spawned by Remote Desktop Audit
• Monitor for suspicious file downloads with import-compatible extensions targeting users of Remote Desktop Audit

Monitoring Recommendations

• Enable enhanced logging for application crashes and access violation exceptions on systems running Remote Desktop Audit
• Monitor network shares and email attachments for files being distributed to users of Remote Desktop Audit
• Implement SentinelOne's behavioral AI to detect SEH-based exploitation attempts and shellcode execution patterns
• Review user activity logs for file import operations in Remote Desktop Audit, particularly from untrusted sources

How to Mitigate CVE-2020-37074

Immediate Actions Required

• Restrict use of Remote Desktop Audit version 2.3.0.157 until a patched version is available
• Educate users to avoid importing computer list files from untrusted or unknown sources
• Implement network segmentation to limit the impact of potential compromise on systems running the vulnerable software
• Deploy endpoint protection solutions capable of detecting buffer overflow and SEH bypass exploitation techniques

Patch Information

Check with Lizard Systems for updated versions of Remote Desktop Audit that address this buffer overflow vulnerability. Visit the Lizard Systems Remote Desktop Audit product page for the latest version information and security updates. Until a patch is available, organizations should implement the workarounds listed below.

Workarounds

• Disable or restrict access to the Add Computers Wizard file import functionality if not operationally required
• Implement application sandboxing to contain potential exploitation within an isolated environment
• Use Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) system-wide to make exploitation more difficult
• Consider using alternative remote desktop auditing tools that do not contain this vulnerability

Organizations using SentinelOne can leverage the platform's behavioral AI engine to detect and block exploitation attempts targeting this vulnerability, including SEH bypass techniques and shellcode execution, providing protection even before official patches are available.