Unquoted Service Path Vulnerability in Winstep Xtreme Service by Winstep
CVE-2020-37253
8.5HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2020-37253?
The Winstep Xtreme Service version 18.06.0096 is susceptible to an unquoted service path vulnerability. This issue allows local attackers to escalate privileges by placing malicious executables in the Program Files directory. When the Winstep Xtreme Service starts, it may inadvertently execute these malicious files with LocalSystem privileges, potentially compromising the system's security.
Affected Version(s)
Winstep 18.06.0096
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.