CVE-2020-36952
Published: 26 January 2026
Summary
CVE-2020-36952 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Iobit (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36952 is an unquoted service path vulnerability (CWE-428) in IObit Uninstaller 10 Pro, specifically affecting the IObit Uninstaller Service. This flaw allows local users to potentially execute arbitrary code with elevated system privileges. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-26.
A local attacker with low privileges can exploit the unquoted service path during IObit Uninstaller Service startup. By inserting malicious code into the vulnerable path, the attacker achieves code execution with SYSTEM-level permissions, enabling full control over the system including high impacts to confidentiality, integrity, and availability.
Advisories and references include an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/49371), the vendor site at https://www.iobit.com, and a detailed advisory from Vulncheck (https://www.vulncheck.com/advisories/iobit-uninstaller-pro-unquoted-service-path), which security practitioners should consult for mitigation guidance and any available patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30855
Vulnerability details
IObit Uninstaller 10 Pro contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted service path in the IObit Uninstaller Service to insert malicious code that would…
more
execute with SYSTEM-level permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path (T1574.009) for local privilege escalation to SYSTEM (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path flaw in IObit Uninstaller Service through timely identification, reporting, patching, and verification.
Enforces secure configuration settings for services, including quoted binary paths and restrictive permissions on intermediate directories to block exploitation.
Applies least privilege to file system access, preventing low-privileged local users from writing malicious executables to paths exploitable by the unquoted service path.