Security readout for executives and security teams
Plain-English summary
CVE-2020-37140 is a local denial-of-service issue in FinalWire Everest 5.50.2100, later associated with AIDA64. A user action in the Open File dialog can crash the application. This affects application availability, not data confidentiality or integrity, based on the provided CVSS vector.
Executive priority
Treat this as a moderate-priority cleanup item. It can disrupt local use of a legacy diagnostic application but does not indicate remote compromise or data theft in the provided evidence. Prioritize removal or replacement where the software is unnecessary or unsupported.
Technical view
The issue is reported as CWE-787 in Everest 5.50.2100. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, meaning local access and user interaction are required, with high availability impact to the application. Public exploit information exists, but the source bundle does not identify active exploitation.
Likely exposure
Exposure is likely limited to endpoints where Everest 5.50.2100 is installed and used locally. Systems without this specific version are not shown as affected by the provided sources. The issue is most relevant where the tool is still present on administrator or diagnostic workstations.
Exploitation context
The vulnerability requires local interaction with the application’s file-open functionality and results in an application crash. It is not listed in CISA KEV, and the provided sources do not claim active exploitation. ExploitDB availability means the behavior is publicly documented.
Researcher notes
The record identifies a local, UI-required denial-of-service condition with public exploit documentation. Evidence is narrow: only Everest 5.50.2100 is listed as affected. No patch, fixed version, or active exploitation claim is provided in the source bundle.
Mitigation direction
- Inventory endpoints for FinalWire Everest 5.50.2100.
- Check FinalWire or AIDA64 guidance for supported versions and fixes.
- Remove the affected version if it is no longer needed.
- Restrict use of the application to trusted local users.
- Avoid opening untrusted or unexpected inputs with the application.
Validation and detection
- Confirm whether Everest 5.50.2100 is installed.
- Record product version from software inventory or endpoint management tools.
- Review whether the application is business-critical or legacy-only.
- Check vendor resources for replacement or update guidance.
- Monitor for repeated application crashes on affected endpoints.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-37140 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-48259CVE reference · exploit
- Archived Product PageCVE reference · vendor-advisory
- VulnCheck Advisory: Everest 5.50.2100 - 'Open File' Denial of ServiceCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.