{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2020-37229/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2020-37229"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sPSV Port Manager 1.0.41"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","unquoted service path","cve-2020-37229","windows"],"_cs_type":"advisory","_cs_vendors":["OKI"],"content_html":"\u003cp\u003eOKI sPSV Port Manager 1.0.41 is vulnerable to an unquoted service path vulnerability (CVE-2020-37229). The sPSVOpLclSrv service, due to its unquoted path, allows a local attacker to escalate privileges on the targeted system. This vulnerability enables an attacker to insert and execute arbitrary code with LocalSystem privileges. The exploit typically involves placing a malicious executable in a directory within the service\u0026rsquo;s path, which executes upon service restart or system reboot. This poses a significant risk in environments where the vulnerable software is installed, as it can lead to complete system compromise by a local attacker.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains low-privilege access to the target Windows system.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the vulnerable service, sPSVOpLclSrv, and its unquoted service path.\u003c/li\u003e\n\u003cli\u003eAttacker creates a malicious executable (e.g., payload.exe) designed to elevate privileges.\u003c/li\u003e\n\u003cli\u003eAttacker places the malicious executable in a directory within the unquoted service path (e.g., C:\\Program Files\\OKI\\sPSV Port Manager\\payload.exe).\u003c/li\u003e\n\u003cli\u003eAttacker triggers a restart of the sPSVOpLclSrv service or reboots the system.\u003c/li\u003e\n\u003cli\u003eThe operating system attempts to execute the service using the unquoted path, inadvertently executing the malicious executable placed by the attacker.\u003c/li\u003e\n\u003cli\u003eThe malicious executable runs with LocalSystem privileges, granting the attacker elevated access.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the elevated privileges to perform malicious actions, such as installing backdoors, creating new user accounts, or exfiltrating sensitive data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this unquoted service path vulnerability (CVE-2020-37229) allows a local attacker to escalate privileges to LocalSystem. This level of access grants the attacker complete control over the compromised system, enabling them to install malware, steal sensitive information, or disrupt critical business operations. The vulnerability affects systems running OKI sPSV Port Manager 1.0.41.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the necessary patch or upgrade to a version of OKI sPSV Port Manager that addresses CVE-2020-37229.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect Unquoted Service Path Exploitation - OKI sPSV Port Manager\u0026rdquo; to identify potential exploitation attempts by monitoring process creations related to the vulnerable service.\u003c/li\u003e\n\u003cli\u003eRegularly audit service configurations to identify and remediate unquoted service paths, mitigating this class of vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-16T16:17:53Z","date_published":"2026-05-16T16:17:53Z","id":"https://feed.craftedsignal.io/briefs/2026-05-cve-2020-37229-unquoted-service-path/","summary":"OKI sPSV Port Manager 1.0.41 contains an unquoted service path vulnerability in the sPSVOpLclSrv service, allowing local attackers to escalate privileges by inserting executable files into the unquoted path.","title":"OKI sPSV Port Manager Unquoted Service Path Vulnerability (CVE-2020-37229)","url":"https://feed.craftedsignal.io/briefs/2026-05-cve-2020-37229-unquoted-service-path/"}],"language":"en","title":"CraftedSignal Threat Feed — Cve-2020-37229","version":"https://jsonfeed.org/version/1.1"}