CVE-2020-36977
Published: 27 January 2026
Summary
CVE-2020-36977 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wondershare Driver Install (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 8.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2020-36977 is an unquoted service path vulnerability in the Wondershare Driver Install Service, specifically within the ElevationService executable. This issue, classified under CWE-428, enables local attackers to potentially inject malicious code by exploiting the unquoted path to replace the service binary with a malicious executable. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H) and affects Wondershare software components, such as those associated with Dr.Fone.
A local attacker with low privileges can exploit this vulnerability through low-complexity means without requiring user interaction. By leveraging the unquoted service path, the attacker can position a malicious executable in a directory that the system searches before the legitimate binary, leading to execution of the malicious code under the service's elevated context and enabling privilege escalation to the LocalSystem account with high impacts on confidentiality, integrity, and availability.
Advisories, including one from Vulncheck, describe the unquoted service path flaw in Wondershare's Driver Install Service ElevationService. A proof-of-concept exploit is publicly available on Exploit-DB under ID 49101. References to Wondershare's official sites, such as wondershare.com and drfone, provide context on the affected products, though specific patch details are not outlined in the CVE information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30872
Vulnerability details
Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attackers to potentially inject malicious code. Attackers can exploit the unquoted path to replace the service binary with a malicious executable, enabling privilege…
more
escalation to LocalSystem account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unquoted service path in ElevationService enables path interception for binary replacement and LocalSystem execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for services, including properly quoting executable paths to directly prevent exploitation of unquoted service path vulnerabilities like CVE-2020-36977.
Requires services to run with least privilege accounts rather than LocalSystem, mitigating privilege escalation even if the unquoted path is exploited.
Prohibits or restricts unnecessary services such as the Wondershare ElevationService, eliminating the vulnerable component entirely.