CVE-2020-37062
Unquoted Service Path Vulnerability in DHCP Turbo Enables Privilege Escalation
Publication date: 2026-02-01
Last updated on: 2026-02-01
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| weird_solutions | dhcp_turbo | 4.61298 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unquoted service path issue in DHCP Turbo version 4.6.1298. Because the service binary path is not enclosed in quotes, a local attacker can place a malicious executable in a path segment that the system might execute instead of the intended service binary. This allows the attacker to execute arbitrary code with elevated privileges when the service starts. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow a local attacker to escalate their privileges to those of the LocalSystem account, effectively gaining full control over the affected system. This can lead to unauthorized code execution, system compromise, and potential data breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the service binary path for unquoted spaces. On Windows, use the command: sc qc "DHCP Turbo 4" to query the service configuration and inspect the BINARY_PATH_NAME for missing quotes around the path. If the path is unquoted and contains spaces, the system is vulnerable to this unquoted service path issue. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the service binary path to include quotes around the entire path to prevent the system from misinterpreting the path segments. Alternatively, ensure that no malicious executables can be placed in any directory segments of the service path. Running the service with the least privileges necessary and restricting local user access can also reduce risk. [1]