CVE-2020-36974
Published: 27 January 2026
Summary
CVE-2020-36974 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Realtek Andrea RT (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2020-36974 is an unquoted service path vulnerability affecting Realtek Andrea RT Filters version 1.0.64.7. The issue resides in the service path for AESTSr64.exe, registered as 'C:\Program Files\IDT\WDM\AESTSr64.exe', which lacks proper quoting. This classic misconfiguration (CWE-428) enables local privilege escalation, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this by placing a malicious executable in a directory that precedes 'Program Files' in the unquoted path resolution, such as C:\Program.exe. Upon service startup or system reboot, the malicious code executes with elevated SYSTEM privileges, potentially granting full control over the affected system.
Advisories from Vulncheck detail the unquoted path in AESTSr64.exe, while Exploit-DB hosts a proof-of-concept exploit (ID 49158). The Realtek website provides general vendor information, but no specific patch details are referenced in available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30875
Vulnerability details
Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in 'C:\Program Files\IDT\WDM\AESTSr64.exe' to inject malicious code that would execute…
more
during service startup or system reboot.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in AESTSr64.exe directly enables path interception by placing a malicious executable (e.g., C:\Program.exe) that executes with SYSTEM privileges on service start.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for system services, including proper quoting of executable paths to directly prevent unquoted service path exploitation.
Requires timely identification, reporting, and remediation of flaws such as unquoted service paths, eliminating the vulnerability before exploitation.
Mandates vulnerability scanning that specifically identifies unquoted service path vulnerabilities like CVE-2020-36974 for proactive mitigation.