CVE-2020-36990
Published: 28 January 2026
Summary
CVE-2020-36990 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Inputdirector (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36990 is an unquoted service path vulnerability in the Windows service configuration of Input Director 1.4.3. This flaw, classified under CWE-428, enables local attackers to execute arbitrary code with elevated privileges due to the service's improper handling of paths containing spaces, as rated 7.8 on the CVSS v3.1 scale (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local attackers with low privileges can exploit the vulnerability during system startup or reboot by placing a malicious executable along the unquoted service path. Successful exploitation allows the attacker to inject and run code with LocalSystem permissions, potentially compromising the entire system through high-impact confidentiality, integrity, and availability violations.
Advisories and related resources, including a proof-of-concept exploit, are available at https://www.exploit-db.com/exploits/48795, the vendor site https://www.inputdirector.com/, and VulnCheck's advisory at https://www.vulncheck.com/advisories/input-director-input-director-unquoted-service-path.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30898
Vulnerability details
Input Director 1.4.3 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious…
more
executables with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) in Windows service directly enables path interception by placing malicious binary in the search path, leading to execution with LocalSystem privileges.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the unquoted service path flaw in Input Director to eliminate the vulnerability enabling local privilege escalation.
Mandates secure configuration settings for Windows services, including quoted paths and restrictive directory permissions to prevent hijacking by local attackers.
Limits system to least functionality by prohibiting unnecessary vulnerable services like Input Director, reducing exposure to unquoted path exploits.