TFTP Broadband Unquoted Service Path Privilege Escalation

Executive Summary

CVE-2020-37250 is an unquoted service path vulnerability in the tftpt.exe service binary of TFTP Broadband version 4.3.0.1465. Because the service path is not properly enclosed in quotes, local attackers can place a malicious executable in the Program Files directory path. When the service starts or the system reboots, this malicious executable can be run with LocalSystem privileges, allowing arbitrary code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows local attackers to escalate their privileges by executing arbitrary code with system-level (LocalSystem) privileges. This means an attacker could gain full control over the affected system, potentially installing malware, stealing data, or disrupting system operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the service path for the tftpt.exe service binary is unquoted. Specifically, you need to verify whether the service path contains spaces and is not enclosed in quotation marks.

On a Windows system, you can use the following command to check the service path for the TFTP Broadband service:

• sc qc "TFTP Broadband"

Look for the BINARY_PATH_NAME output. If the path contains spaces and is not enclosed in quotes (e.g., C:\Program Files\TFTP Broadband 4\tftpt.exe without quotes), the system is vulnerable.

Additionally, you can use PowerShell to query the service path:

• Get-WmiObject win32_service | Where-Object { $_.Name -eq 'TFTP Broadband' } | Select-Object PathName

Review the PathName property for unquoted paths with spaces.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the unquoted service path vulnerability in TFTP Broadband 4.3.0.1465 directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately ensure that the service path for the tftpt.exe executable is properly quoted to prevent execution of malicious executables placed in directories with spaces.

You can do this by modifying the service configuration to enclose the executable path in quotation marks. For example, change the service path from:

• C:\Program Files\TFTP Broadband 4\tftpt.exe

to

• "C:\Program Files\TFTP Broadband 4\tftpt.exe"

Alternatively, you can uninstall or stop the vulnerable service until a patched version is available.

Restrict local user permissions to prevent unauthorized users from placing executables in the Program Files directory.

Useful 0 Not Useful 0