CVE-2020-36959
Published: 26 January 2026
Summary
CVE-2020-36959 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Pconlife (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36959 is an unquoted service path vulnerability affecting IDT PC Audio version 1.0.6499.0. The issue resides in the STacSV service, where the unquoted path allows local users to potentially execute arbitrary code with elevated system privileges by injecting malicious code that runs under LocalSystem account permissions during service startup. It is classified under CWE-428 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local attackers with low privileges (PR:L) can exploit this vulnerability with low complexity and no user interaction required. By placing a malicious executable in a directory controlled by the attacker along the unquoted service path, they can achieve arbitrary code execution with SYSTEM-level privileges when the STacSV service starts, potentially leading to full system compromise including high impacts on confidentiality, integrity, and availability.
Advisories and related resources, including an exploit on Exploit-DB (https://www.exploit-db.com/exploits/49191), a download link (https://www.pconlife.com/download/otherfile/20566/90674cffc8658c4f2bf58d43bb9b7ccb/), and a Vulncheck advisory (https://www.vulncheck.com/advisories/idt-pc-audio-stacsv-unquoted-service-path), provide further details on the issue. The vulnerability was published on 2026-01-26T18:16:26.840, with an available proof-of-concept exploit indicating potential for real-world local privilege escalation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30853
Vulnerability details
IDT PC Audio 1.0.6499.0 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the STacSV service to inject malicious code that would execute…
more
with LocalSystem account permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in STacSV directly enables path interception for SYSTEM-level code execution (T1574.009) and local privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces and documents secure configuration settings for system components, including properly quoted service executable paths to directly prevent exploitation of unquoted service path vulnerabilities like that in STacSV.
Requires identification, reporting, and timely correction of flaws such as the unquoted service path in IDT PC Audio STacSV, mitigating the vulnerability through patching or reconfiguration.
Employs least privilege for system processes and services like STacSV, limiting the privileges available to malicious code executed via the unquoted path and reducing escalation impact.