CVE-2020-37016
Published: 29 January 2026
Summary
CVE-2020-37016 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Barcode Ocr (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces secure configuration settings for services, including proper quoting of executable paths to directly prevent unquoted service path exploitation.
Identifies, reports, and corrects system flaws like the unquoted service path in this CVE, remediating the vulnerability before exploitation.
Establishes and maintains a baseline configuration that excludes misconfigurations such as unquoted service paths, preventing deployment of vulnerable services.
NVD Description
BarcodeOCR 19.3.6 contains an unquoted service path vulnerability that allows local attackers to execute code with elevated privileges during system startup. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will run with LocalSystem…
more
privileges.
Deeper analysisAI
CVE-2020-37016 is an unquoted service path vulnerability affecting BarcodeOCR version 19.3.6. This flaw exists in the service configuration, where the path to the executable lacks proper quotation, enabling local privilege escalation. The vulnerability is classified under CWE-428 (Unquoted Search Path or Element) and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
Local attackers with low privileges (PR:L) can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's search path. During system startup, the service attempts to launch the executable from this unquoted path, allowing the attacker's code to execute with LocalSystem privileges. Successful exploitation grants full system-level access, potentially enabling persistence, data theft, or further compromise.
Advisories from VulnCheck and a proof-of-concept exploit on Exploit-DB document the issue, highlighting the unquoted path in the BarcodeOCR service configuration. The vendor's site at barcode-ocr.com provides additional context on the software. No specific patch details are outlined in the available references.
A public exploit is available on Exploit-DB (ID 48740), demonstrating practical exploitation feasibility for affected systems.
Details
- CWE(s)