CVE-2020-36987
Published: 28 January 2026
Summary
CVE-2020-36987 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Gearboxcomputers (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2020-36987 is an unquoted service path vulnerability in Program Access Controller version 1.2.0.0, specifically affecting the PACService.exe component. This issue, classified under CWE-428, enables local attackers to execute arbitrary code with elevated privileges by exploiting the unquoted path in the service configuration. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for privilege escalation.
A local attacker with low privileges can exploit the vulnerability during system startup or reboot. By placing a malicious executable in a directory traversed by the unquoted service path, the attacker causes the service to execute the malware instead of the intended PACService.exe. This results in code execution under LocalSystem permissions, granting full system access with high impacts on confidentiality, integrity, and availability.
Advisories and references provide additional details on the issue, including a proof-of-concept exploit at https://www.exploit-db.com/exploits/48966, a vendor-related page at https://www.gearboxcomputers.com/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/program-access-controller-pacserviceexe-unquoted-service-path. These resources outline the vulnerability but do not specify patches in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30895
Vulnerability details
Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with…
more
LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service directly enables path interception for privilege escalation via malicious executable placement in the search path.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for services, including properly quoting executable paths to directly prevent exploitation of unquoted service path vulnerabilities like CVE-2020-36987.
Requires services to operate with least privilege, preventing privilege escalation to LocalSystem even if an attacker hijacks the unquoted service path.
Vulnerability scanning periodically identifies unquoted service path vulnerabilities such as CVE-2020-36987 in system services.