CVE-2020-37185: Backup Key Recovery DOS Vulnerability

CVE-2020-37185 Overview

CVE-2020-37185 is a denial of service vulnerability affecting Backup Key Recovery version 2.2.5. The vulnerability allows attackers to crash the application by overflowing the 'Name' input field in the registration dialog. By generating a payload of approximately 1000 characters and pasting it into the registration name field, an attacker can trigger an application crash, disrupting normal operations.

Critical Impact

Local attackers can cause application crashes through input field overflow, leading to denial of service conditions that disrupt backup key recovery operations.

Affected Products

• Backup Key Recovery 2.2.5

Discovery Timeline

• 2026-02-11 - CVE CVE-2020-37185 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2020-37185

Vulnerability Analysis

This vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The application fails to properly validate the length of user-supplied input in the 'Name' registration field before copying it to a fixed-size buffer.

When a user enters or pastes an excessively long string (approximately 1000 characters) into the Name field, the application attempts to process this input without adequate bounds checking. This results in memory corruption that causes the application to crash. The local attack vector requires user interaction, as the attacker must either have local access to the system or convince a user to paste malicious content into the field.

Root Cause

The root cause of this vulnerability is improper input validation in the registration name field handler. The application allocates a fixed-size buffer for the Name field but does not enforce length restrictions on user input before copying data into this buffer. This classic buffer overflow pattern (CWE-120) occurs when the application performs a buffer copy operation without checking if the source data exceeds the destination buffer's capacity.

Attack Vector

This is a local attack vector vulnerability that requires user interaction for exploitation. An attacker with local access to a system running Backup Key Recovery 2.2.5 can exploit this vulnerability by:

1. Opening the application's registration dialog
2. Generating a payload string of approximately 1000 characters
3. Pasting the oversized string into the 'Name' input field
4. Triggering an immediate application crash

The vulnerability could also be exploited through social engineering, where an attacker convinces a user to copy and paste a crafted string into the registration field. Technical details and a proof-of-concept are available in the Exploit-DB #47909 entry.

Detection Methods for CVE-2020-37185

Indicators of Compromise

• Unexpected crashes of the Backup Key Recovery application
• Windows Event Log entries showing application faults related to bkrecover.exe or similar process names
• Crash dump files indicating memory access violations in the application

Detection Strategies

• Monitor for repeated application crashes in the Backup Key Recovery software
• Implement endpoint detection rules to identify buffer overflow patterns in desktop applications
• Review system event logs for application fault events associated with Backup Key Recovery

Monitoring Recommendations

• Enable application crash monitoring through Windows Error Reporting
• Configure SentinelOne endpoint agents to detect and alert on application instability patterns
• Monitor clipboard operations for unusually large text strings being pasted into applications

How to Mitigate CVE-2020-37185

Immediate Actions Required

• Avoid using the registration functionality in Backup Key Recovery 2.2.5 until a patch is available
• Restrict local access to systems running vulnerable versions of the software
• Consider migrating to alternative backup key recovery solutions with proper input validation
• Monitor for application crashes that may indicate exploitation attempts

Patch Information

No vendor patch information is currently available for this vulnerability. Users should monitor the NSAuditor website for security updates and newer versions of the software. Additional advisory information is available from VulnCheck.

Workarounds

• Avoid entering or pasting untrusted data into the registration Name field
• Limit access to the application to trusted users only
• Consider using alternative backup key recovery tools until a patched version is released
• Implement application whitelisting policies that restrict execution to verified versions