CVE-2020-36976
Published: 27 January 2026
Summary
CVE-2020-36976 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Acer Global Registration (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2020-36976 is an unquoted service path vulnerability in Acer Global Registration Service version 1.0.0.3. The issue affects the service configuration, where the path "C:\Program Files (x86)\Acer\Registration\" lacks proper quoting, enabling local users to potentially execute arbitrary code by injecting malicious executables into exploitable locations along the path resolution.
Local users with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction required (UI:N). During service startup, a malicious executable placed in a suitable directory would execute with elevated LocalSystem privileges, resulting in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as scored at 7.8 under CVSS v3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-428.
Advisories and related resources, including a VulnCheck advisory at https://www.vulncheck.com/advisories/global-registration-service-gregsvcexe-unquoted-service-path and an Exploit-DB proof-of-concept at https://www.exploit-db.com/exploits/49142, provide further details on the issue; Acer's support page is available at https://www.acer.com/ac/en/US/content/home. The CVE was published on 2026-01-27T19:16:10.253.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30873
Vulnerability details
Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\Acer\Registration\ to inject malicious executables that would…
more
run with elevated LocalSystem privileges during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service directly maps to path interception by unquoted path, enabling local privilege escalation via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires secure configuration settings for services, including proper quoting of executable paths to prevent exploitation of unquoted service paths like in Acer Global Registration Service.
Directly mandates identification, reporting, and correction of flaws such as the unquoted service path vulnerability in CVE-2020-36976.
Establishes secure baseline configurations that include properly quoted service paths to mitigate unquoted path vulnerabilities from the outset.