CVE-2020-36933
Published: 25 January 2026
Summary
CVE-2020-36933 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Htc (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2020-36933 is an unquoted service path vulnerability in HTC IPTInstaller version 4.0.9, specifically within the PassThru Service configuration. This issue, mapped to CWE-428, stems from an unquoted binary path that enables attackers to inject and execute malicious code. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its potential for significant impact on affected systems.
A local attacker with low privileges can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's search path. Successful exploitation grants LocalSystem-level privileges, allowing full control over the system, including unauthorized access to sensitive data, modification of critical files, and disruption of services.
Advisories from Vulncheck detail the unquoted service path issue in the IPTInstaller PassThru Service, while a proof-of-concept exploit is available on Exploit-DB. The vendor HTC site provides general context, though specific patch information is not outlined in the provided references. Published on 2026-01-25, no further mitigation steps are specified in the available data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4631
Vulnerability details
HTC IPTInstaller 4.0.9 contains an unquoted service path vulnerability in the PassThru Service configuration. Attackers can exploit the unquoted binary path to inject and execute malicious code with elevated LocalSystem privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path for privilege escalation to LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure and restrictive configuration settings for system components, including properly quoting service binary paths to directly prevent exploitation of unquoted service path vulnerabilities like CVE-2020-36933.
Requires identification, reporting, and timely correction of system flaws, directly addressing the unquoted service path vulnerability in HTC IPTInstaller by applying patches or configuration fixes.
Implements vulnerability scanning to identify configuration weaknesses such as unquoted service paths in the PassThru Service, enabling early detection of CVE-2020-36933.