CVE-2016-20055
Iobit Advanced System Care ≤ 10.0.2
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2016-20055 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Iobit Advanced System Care. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2016-20055 is an unquoted service path vulnerability in IObit Advanced SystemCare version 10.0.2, specifically affecting the AdvancedSystemCareService10 Windows service. The issue, classified under CWE-428, arises because the service binary path is not properly quoted, allowing local attackers to escalate privileges. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact with low attack complexity for local users.
A local attacker with low privileges can exploit this by placing a malicious executable in a directory that precedes the legitimate service binary in the Windows search path, such as within the parent directories of the service's path. When the AdvancedSystemCareService10 restarts or the system reboots, the service launcher executes the malicious binary instead, running it with LocalSystem privileges and enabling full system compromise, including arbitrary code execution with high confidentiality, integrity, and availability impacts.
Advisories from VulnCheck detail the unquoted service path privilege escalation, while Exploit-DB hosts a public exploit (ID 40577) demonstrating the attack. References to IObit product pages, including the Advanced SystemCare free download, are provided, but specific patch or mitigation instructions from the vendor are not detailed in the CVE information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2016-10862
Vulnerability Data
IObit Advanced SystemCare 10.0.2 contains an unquoted service path vulnerability in the AdvancedSystemCareService10 service that allows local attackers to escalate privileges. Attackers can place a malicious executable in the service path and trigger privilege escalation when the service restarts or…
more
the system reboots, executing code with LocalSystem privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) in Windows service directly enables path interception by unquoted path for privilege escalation to LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws like the unquoted service path vulnerability in AdvancedSystemCareService10 to prevent local privilege escalation.
Enforces secure configuration settings for Windows services, including properly quoted binary paths, directly preventing exploitation of unquoted service path vulnerabilities.
Applies least privilege to services like AdvancedSystemCareService10, limiting the damage from privilege escalation even if the unquoted path is exploited.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent path-handling flaws such as unquoted elements during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect unquoted search-path issues before deployment.
Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.
Secure development lifecycle practices include input validation and path handling that reduce unquoted search-path weaknesses.
Secure system architecture and engineering principles require safe path construction and quoting conventions.
Secure coding standards directly mandate quoting search paths and avoiding unsafe path construction.
Change-management processes can enforce review of path-handling changes that might introduce unquoted elements.