CVE-2020-37101
Unquoted Service Path Vulnerability in VPN Unlimited Allows Privilege Escalation
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| keepsolid | vpn_unlimited | 6.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2020-37101 is an unquoted service path vulnerability in VPN Unlimited version 6.1. The service executable path "C:\\Program Files (x86)\\VPN Unlimited\\vpn-unlimited-daemon.exe" is not enclosed in quotation marks. Because the path contains spaces and is unquoted, a local attacker can place a malicious executable in a path segment that the system might execute instead of the legitimate service binary.'}, {'type': 'paragraph', 'content': 'This vulnerability allows local attackers to inject malicious executables into the service binary path, effectively replacing the legitimate service executable.'}, {'type': 'paragraph', 'content': 'Exploiting this flaw enables attackers to gain elevated system privileges by executing their malicious code with the same privileges as the service.'}] [1, 3]
How can this vulnerability impact me? :
This vulnerability can lead to local privilege escalation, allowing an attacker with local access to execute malicious code with elevated system privileges.
An attacker exploiting this flaw can replace the legitimate VPN Unlimited service executable with a malicious one, potentially compromising the entire system.
The impact includes full control over the affected system, which can lead to unauthorized access to sensitive data, system manipulation, and disruption of service availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking the service path of the VPN Unlimited service for unquoted spaces. Specifically, you need to verify if the service binary path "C:\\Program Files (x86)\\VPN Unlimited\\vpn-unlimited-daemon.exe" is unquoted.'}, {'type': 'paragraph', 'content': 'On a Windows system, you can use the following command to check the service path for unquoted spaces:'}, {'type': 'list_item', 'content': 'sc qc VPNUnlimitedService'}, {'type': 'paragraph', 'content': 'If the path returned by this command is unquoted and contains spaces, it indicates the presence of the vulnerability. Additionally, you can manually inspect the service properties via the Services MMC snap-in (services.msc) to check the executable path.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate this vulnerability, you should ensure that the service path for VPN Unlimited is properly quoted to prevent malicious executable injection.'}, {'type': 'paragraph', 'content': 'Immediate steps include:'}, {'type': 'list_item', 'content': 'Modify the service binary path to be enclosed in quotation marks, for example: ""C:\\Program Files (x86)\\VPN Unlimited\\vpn-unlimited-daemon.exe"".'}, {'type': 'list_item', 'content': 'If possible, update VPN Unlimited to a version where this vulnerability is fixed.'}, {'type': 'list_item', 'content': 'Restrict local user permissions to prevent unauthorized users from placing executables in directories that could be exploited.'}, {'type': 'list_item', 'content': 'Monitor and audit the directories in the service path for any suspicious or unauthorized files.'}] [1, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows local attackers to gain elevated system privileges by injecting malicious executables into the VPN Unlimited service binary path. This can lead to unauthorized access and potential compromise of sensitive data.
Such unauthorized access and potential data compromise could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information against unauthorized access and breaches.
However, the provided information does not explicitly discuss the direct effects of this vulnerability on compliance with these standards.