CVE-2020-36977

Summary

Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attackers to potentially inject malicious code. Attackers can exploit the unquoted path to replace the service binary with a malicious executable, enabling privilege escalation to LocalSystem account.

Affected Software

Weaknesses

• CWE-428: Unquoted Search Path or Element

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://www.exploit-db.com/exploits/49101

References

• https://www.exploit-db.com/exploits/49101
• https://www.wondershare.com/
• https://www.wondershare.com/drfone/
• https://www.vulncheck.com/advisories/wondershare-driver-install-service-help-elevationservice-unquote-service-path

• ←Previous
• Next→