CVE-2020-37058
Unquoted Service Path Vulnerability in Andrea ST Filters Service
Publication date: 2026-01-30
Last updated on: 2026-01-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| andrea | st_filters_service | 1.0.64.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2020-37058 is an unquoted service path vulnerability in Andrea ST Filters Service version 1.0.64.7 on Windows. The service executable path is not enclosed in quotes and contains spaces, which allows a local attacker to inject malicious code into the path. When the service starts, this malicious code executes with elevated LocalSystem privileges, potentially leading to full system compromise. [1, 3]
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary code execution with elevated LocalSystem privileges. A local attacker who can write to a directory in the service path can inject malicious executables that run with high privileges during service startup, potentially resulting in full system compromise including loss of confidentiality, integrity, and availability. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying unquoted service paths in Windows services that start automatically and are not located in the Windows directory. Commands such as Windows Management Instrumentation Command-line (WMIC) and Service Control (sc) can be used to list services and check their executable paths for unquoted spaces. For example, using WMIC: `wmic service get name,pathname,startmode | findstr /i "Auto"` to find services with automatic start mode and then inspecting the paths for unquoted spaces. Using `sc qc <service_name>` can show the binary path of a specific service to verify if it is unquoted. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include correcting the unquoted service path by enclosing the service executable path in double quotes to prevent malicious code injection. This can be done by modifying the service configuration to ensure the path is properly quoted. Additionally, restricting write permissions on directories in the service path can help prevent attackers from placing malicious executables. Ensuring that only trusted users have local access and monitoring for suspicious files in service directories are also recommended. [1, 3]