CVE-2020-36980
Published: 27 January 2026
Summary
CVE-2020-36980 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Segurazo (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, ranked at the 3.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and correction of flaws like unquoted service paths through patches or configuration fixes.
CM-6 mandates establishing and enforcing secure configuration settings for services, including proper quoting of executable paths to block hijacking.
CM-2 ensures baseline configurations document and maintain secure service path settings that prevent unquoted path vulnerabilities.
NVD Description
SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted executable path to inject malicious files in the service binary path, enabling…
more
privilege escalation to system-level permissions.
Deeper analysisAI
CVE-2020-36980 is an unquoted service path vulnerability in SAntivirus IC version 10.0.21.61. The issue affects the Windows service configuration of this antivirus software, where the service binary path lacks proper quoting, enabling potential exploitation by local attackers to execute arbitrary code through path traversal.
Local attackers with low privileges (PR:L) can exploit this vulnerability given local access (AV:L) and low complexity (AC:L), without requiring user interaction (UI:N). By injecting malicious files into directories traversed by the unquoted executable path, attackers achieve privilege escalation to system-level permissions, resulting in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in the CVSS v3.1 base score of 7.8. The vulnerability maps to CWE-428 (Unquoted Search Path or Element).
References include a proof-of-concept exploit at https://www.exploit-db.com/exploits/49042, the vendor download page at https://www.segurazo.com/download.html, and a VulnCheck advisory at https://www.vulncheck.com/advisories/santivirus-ic-santivirusic-unquoted-service-path, which detail the issue and potential remediation steps such as service path correction or software updates.
Details
- CWE(s)