CVE-2020-37048
Unquoted Service Path in Iskysoft Framework Enables Privilege Escalation
Publication date: 2026-02-01
Last updated on: 2026-02-01
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| iskysoft | application_framework_service | 2.4.3.241 |
| iskysoft | application_framework_service | to 2.4.3.241 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unquoted service path issue in the Iskysoft Application Framework Service version 2.4.3.241. Because the service executable path contains spaces and is not enclosed in quotes, a local attacker can place a malicious executable in a directory path that the system might misinterpret during service startup. This causes the malicious code to be executed with the elevated privileges of the service, allowing arbitrary code execution with high-level system permissions. [1, 3]
How can this vulnerability impact me? :
The vulnerability can lead to privilege escalation on affected systems. A local attacker with limited privileges can exploit the unquoted service path to execute arbitrary code with elevated system-level privileges. This means the attacker can run malicious code with the same high-level permissions as the Iskysoft Application Framework Service, potentially compromising the entire system. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by querying Windows Management Instrumentation Command-line (WMIC) for services with auto start mode and filtering for unquoted paths excluding system directories. Additionally, the service configuration can be checked using the command 'sc qc IsAppService' to confirm the unquoted binary path. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include correcting the unquoted service path by enclosing the executable path in quotes to prevent the system from misinterpreting the path and executing malicious code. Also, ensure that only trusted users have local access to the system to reduce the risk of local code injection. Regularly audit service paths and permissions to detect and prevent exploitation. [1, 3]