Security readout for executives and security teams
Plain-English summary
Redir 3.3 can be remotely crashed by oversized input. The business impact is service disruption, not data theft, based on the provided CVSS details. Public exploit information exists, but the source bundle does not show confirmed active exploitation.
Executive priority
Treat as a high-priority availability risk for any business process depending on Redir 3.3. Prioritize externally reachable deployments first. Urgency is lower if Redir is absent or isolated from untrusted networks.
Technical view
CVE-2020-37182 is a stack-based buffer overflow in Redir 3.3’s doproxyconnect() function. Improper length checking around sprintf() can allow unauthenticated network input to overwrite memory and terminate the process with a segmentation fault. CVSS v4.0 is 8.7 with high availability impact only.
Likely exposure
Exposure is limited to environments running troglobit Redir version 3.3, especially if reachable over a network. The provided sources do not list affected CPEs or additional versions.
Exploitation context
ExploitDB is listed as a public exploit reference, so defenders should assume the crash condition is reproducible. CISA KEV is false in the provided data, and no cited source confirms active exploitation in the wild.
Researcher notes
The source bundle attributes the issue to CWE-121 in doproxyconnect(). Reported impact is denial of service through process termination. No integrity or confidentiality impact is indicated by the supplied CVSS vector. Patch details are not provided in the sources.
Mitigation direction
- Identify and prioritize any Redir 3.3 deployments.
- Restrict network access to Redir services to trusted sources only.
- Check the Redir project and vendor guidance for fixed or supported versions.
- Monitor for repeated crashes, segmentation faults, or unexpected Redir restarts.
- Use service supervision to reduce outage duration where Redir remains required.
Validation and detection
- Inventory hosts for Redir and confirm exact version 3.3 exposure.
- Map whether Redir is reachable from untrusted networks.
- Review system and application logs for Redir crashes or segfaults.
- Confirm firewall or access-control rules limit Redir access.
- Track vendor repository or advisory updates for remediation status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-37182 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-47919CVE reference · exploit
- Redir Project GitHub RepositoryCVE reference · product
- VulnCheck Advisory: Redir 3.3 - Denial of ServiceCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.