CVE-2020-36985
Published: 28 January 2026
Summary
CVE-2020-36985 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Gearboxcomputers (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36985 is an unquoted service path vulnerability in IP Watcher 3.0.0.30, a Windows-based network monitoring tool. The flaw exists in the service configuration, where the binary path for the service lacks proper quotation, allowing Windows path resolution to potentially execute unintended files during service startup.
Local attackers with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction required. By placing a malicious executable in a directory traversed by the unquoted path, the attacker causes it to execute with elevated LocalSystem privileges upon service startup, resulting in high impacts on confidentiality, integrity, and availability (CVSS:3.1 score of 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). This is classified under CWE-428 (Unquoted Search Path or Element).
Advisories, including one from VulnCheck detailing the issue in pacservice.exe, provide technical analysis of the vulnerability. A proof-of-concept exploit is publicly available on Exploit-DB (exploit ID 48968). The vendor site, Gearbox Computers, is referenced in connection with the affected software.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30893
Vulnerability details
IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem…
more
privileges during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path in Windows service binary (pacsrv.exe), enabling path interception for local privilege escalation to LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces and documents secure configuration settings for services, including proper quoting of binary paths to directly prevent unquoted service path exploitation.
Requires identification, reporting, and correction of flaws like unquoted service paths through timely remediation and patching.
Limits the impact of service hijacking by ensuring services operate with the least privileges necessary rather than elevated LocalSystem accounts.