CVE-2020-37074: Remote Desktop Audit Buffer Overflow Flaw

CVE-2020-37074 Overview

CVE-2020-37074 is a buffer overflow vulnerability in Lizard Systems Remote Desktop Audit version 2.3.0.157. The flaw resides in the Add Computers Wizard file import process. Attackers can craft a malicious payload file that triggers a structured exception handler (SEH) overwrite when imported. Successful exploitation allows arbitrary code execution in the context of the user running the application. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input).

Critical Impact
A specially crafted computer list file can overwrite the SEH chain and execute attacker-supplied shellcode, leading to local arbitrary code execution.

Affected Products

Lizard Systems Remote Desktop Audit 2.3.0.157
Add Computers Wizard component
Windows installations running the vulnerable build

Discovery Timeline

2026-02-03 - CVE-2020-37074 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in the NVD database

Technical Details for CVE-2020-37074

Vulnerability Analysis

The vulnerability is a classic stack buffer overflow triggered during file parsing inside the Add Computers Wizard. When a user imports a list of computers, the application reads entries from the supplied file into a fixed-size stack buffer without validating the input length. An oversized entry overflows the buffer and overwrites adjacent stack data, including the saved SEH record. By aligning a crafted payload with the SEH pointer, an attacker controls the next exception handler. When an exception is raised during parsing, execution transfers to attacker-controlled memory. The result is arbitrary code execution under the privileges of the current user.

Root Cause

The root cause is missing bounds checking when copying file-supplied strings into a stack buffer. The application trusts the size and format of imported records and does not enforce a maximum length, which is the defining characteristic of [CWE-120].

Attack Vector

Exploitation requires local user interaction. An attacker must convince a user to open or import a malicious computer list file through the Add Computers Wizard. Distribution typically occurs through phishing, shared drives, or social engineering. No network exposure is required, and no prior authentication to the application is needed.

// No verified exploit code is reproduced here.
// Public proof-of-concept material is available at Exploit-DB entry 48465.
// The payload structure consists of: [padding] + [nSEH jump] + [SEH overwrite -> POP POP RET gadget] + [shellcode]

Detection Methods for CVE-2020-37074

Indicators of Compromise

Unexpected child processes spawned by the Remote Desktop Audit executable, particularly cmd.exe, powershell.exe, or rundll32.exe.
Crash events or Windows Error Reporting entries referencing the Remote Desktop Audit process after a file import action.
Suspicious .txt, .csv, or list files delivered via email or shared storage that are imported into the Add Computers Wizard.

Detection Strategies

Monitor process lineage for Remote Desktop Audit and alert on any process creation that is not part of normal application behavior.
Inspect imported computer list files for unusually long lines, non-printable characters, or shellcode-like byte patterns.
Correlate application crash telemetry with subsequent process execution to identify exception-handler hijacking.

Monitoring Recommendations

Enable command-line and process-creation logging on endpoints running Remote Desktop Audit.
Forward endpoint telemetry to a centralized analytics platform to support retrospective hunting against file imports.
Track file write events for new or modified import files in user profile and shared directories.

How to Mitigate CVE-2020-37074

Immediate Actions Required

Restrict use of Remote Desktop Audit 2.3.0.157 until a vendor-supplied fix has been verified and deployed.
Block import of computer list files received from untrusted sources, including email attachments and external shares.
Run the application as a standard user rather than as an administrator to limit the impact of successful exploitation.

Patch Information

Review the Lizard Systems Remote Desktop Audit product page for the latest release and upgrade beyond version 2.3.0.157. Additional technical details are available in the Vulncheck Advisory on Buffer Overflow and the public proof of concept at Exploit-DB #48465.

Workarounds

Avoid using the Add Computers Wizard file import feature; enter computer names manually where feasible.
Validate all import files in a sandboxed environment before opening them on production workstations.
Apply application allowlisting to prevent unauthorized child processes from launching from the Remote Desktop Audit binary.

bash

# Example: enumerate vulnerable installations across Windows endpoints
Get-ChildItem -Path 'C:\Program Files*\LizardSystems\Remote Desktop Audit' -Recurse -Include *.exe |
  ForEach-Object { (Get-Item $_.FullName).VersionInfo } |
  Where-Object { $_.ProductVersion -like '2.3.0.157*' }