CVE-2020-36953
Published: 26 January 2026
Summary
CVE-2020-36953 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Minitool (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 6.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36953 is an unquoted service path vulnerability affecting MiniTool ShadowMaker version 3.2, specifically in the MTAgentService component. The service is configured with the unquoted path 'C:\Program Files\MiniTool ShadowMaker\AgentService.exe', which enables local attackers to potentially execute arbitrary code by placing malicious executables in intermediate directories. The vulnerability is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-428 (Unquoted Search Path or Element).
Local low-privileged attackers can exploit this vulnerability by creating a malicious executable in a directory such as C:\Program.exe, which the Windows service control manager will execute instead of the legitimate AgentService.exe during service startup. Successful exploitation allows arbitrary code execution with elevated privileges, resulting in high impacts to confidentiality, integrity, and availability.
Advisories and a proof-of-concept exploit are documented in the provided references, including Exploit-DB (https://www.exploit-db.com/exploits/49336), the vendor site (https://www.minitool.com), and Vulncheck (https://www.vulncheck.com/advisories/minitool-shadowmaker-mtagentservice-unquoted-service-path), which detail the issue and potential mitigations such as applying patches or correcting the service path configuration.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30849
Vulnerability details
MiniTool ShadowMaker 3.2 contains an unquoted service path vulnerability in the MTAgentService that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\MiniTool ShadowMaker\AgentService.exe' to inject malicious executables and escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception for arbitrary code execution (T1574.009) leading to local privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces and documents secure configuration settings for system services, including properly quoting executable paths to directly prevent unquoted service path exploitation.
Requires timely flaw remediation for vulnerabilities like the unquoted service path in MiniTool ShadowMaker through patching or configuration fixes.
Mitigates privilege escalation impact by enforcing least privilege for services, reducing confidentiality, integrity, and availability harm if exploited.