CVE-2020-36984
Published: 28 January 2026
Summary
CVE-2020-36984 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Co (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2020-36984 is an unquoted service path vulnerability (CWE-428) in EPSON software version 1.124, specifically affecting the SENADB service. The issue stems from an unquoted path in C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\, which allows local attackers to execute arbitrary code with elevated system privileges. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-28.
Local low-privileged attackers can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's path resolution due to the lack of quotes around the service path. Upon service restart or execution, the injected malicious executable runs with LocalSystem permissions, enabling full system compromise including unauthorized access to sensitive data, modification of system files, and disruption of services.
Advisories and resources for mitigation include Epson's support page for drivers and manuals, a proof-of-concept exploit on Exploit-DB, and a VulnCheck advisory detailing the SENADB service issue. Security practitioners should update to patched Epson software versions where available and apply standard unquoted path mitigations such as renaming services or using quoted paths in configurations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30892
Vulnerability details
EPSON 1.124 contains an unquoted service path vulnerability in the SENADB service that allows local attackers to execute code with elevated system privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\ to inject malicious executables that…
more
will run with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) in Windows service directly enables path interception by placing a malicious binary earlier in the search order, leading to execution as LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path flaw in the EPSON SENADB service through timely patching or vendor updates.
Enforces secure configuration settings for services, including quoted paths and placement in protected directories to block path hijacking exploits.
Requires the SENADB service to run with least privilege rather than LocalSystem, preventing full system compromise even if the unquoted path is exploited.