CVE-2020-36979
Published: 27 January 2026
Summary
CVE-2020-36979 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Boostbyreason (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2020-36979 is an unquoted service path vulnerability in the Windows service configuration of the Atheros Coex Service Application version 8.0.0.255. This issue, mapped to CWE-428, arises from the service executable path lacking proper quotation marks, enabling exploitation during service startup. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability by placing a malicious executable in one of the directories parsed along the unquoted service path. When the service starts or restarts, the system executes the malicious binary instead of the legitimate one, granting the attacker elevated system privileges and potential full control over the affected Windows host.
References include advisories from VulnCheck detailing the unquoted path in the ath_coexagent.exe service and proof-of-concept exploits published on Exploit-DB (exploits/49053). These resources, along with file analysis sites like BoostByReason and File.net, provide further technical details on the affected component. The CVE was published on 2026-01-27T19:16:10.787.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30870
Vulnerability details
Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path by placing malicious executables in the service path to gain elevated system privileges during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by placing a malicious binary in an earlier directory on the service executable path, executed on service start for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and remediation of flaws such as unquoted service paths to prevent exploitation during service startup.
Mandates secure configuration settings for system components, including properly quoting Windows service executable paths to block malicious binary substitution.
Vulnerability scanning tools routinely identify unquoted service path vulnerabilities like this CVE for prioritization and remediation.