CVE-2020-36991
Published: 28 January 2026
Summary
CVE-2020-36991 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Sharemouse (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36991 is an unquoted service path vulnerability in ShareMouse version 5.0.43. The flaw resides in the insecure service path configuration of the ShareMouse service, which allows local users to potentially execute arbitrary code with elevated system privileges by placing malicious executables in specific system directories that are traversed during service startup. This issue is cataloged under CWE-428 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity for local privilege escalation.
The vulnerability can be exploited by local users possessing low privileges (PR:L), requiring low attack complexity (AC:L) and no user interaction (UI:N). Attackers place a malicious executable in a directory included in the unquoted service path, causing the service to inadvertently launch it with SYSTEM-level privileges upon startup, thereby granting elevated access to the system.
Advisories and resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/sharemouse-sharemouse-service-unquoted-service-path and the vendor site at https://www.sharemouse.com/, provide further details on the issue. A proof-of-concept exploit is publicly available at https://www.exploit-db.com/exploits/48794.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30899
Vulnerability details
ShareMouse 5.0.43 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the insecure service path configuration by placing malicious executables in specific system directories to gain elevated…
more
access during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service directly enables path interception for privilege escalation by placing malicious executable in a traversed directory.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
CM-6 enforces secure configuration settings for services, directly preventing unquoted service paths that allow execution of malicious executables during startup.
SI-2 requires timely identification, reporting, and correction of flaws like unquoted service paths, remediating the vulnerability to block privilege escalation.
AC-6 applies least privilege to restrict low-privileged local users from writing malicious executables to directories in the unquoted service path.