CVE-2020-37016
Published: 29 January 2026
Summary
CVE-2020-37016 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Barcode Ocr (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2020-37016 is an unquoted service path vulnerability affecting BarcodeOCR version 19.3.6. This flaw exists in the service configuration, where the path to the executable lacks proper quotation, enabling local privilege escalation. The vulnerability is classified under CWE-428 (Unquoted Search Path or Element) and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
Local attackers with low privileges (PR:L) can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's search path. During system startup, the service attempts to launch the executable from this unquoted path, allowing the attacker's code to execute with LocalSystem privileges. Successful exploitation grants full system-level access, potentially enabling persistence, data theft, or further compromise.
Advisories from VulnCheck and a proof-of-concept exploit on Exploit-DB document the issue, highlighting the unquoted path in the BarcodeOCR service configuration. The vendor's site at barcode-ocr.com provides additional context on the software. No specific patch details are outlined in the available references.
A public exploit is available on Exploit-DB (ID 48740), demonstrating practical exploitation feasibility for affected systems.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30920
Vulnerability details
BarcodeOCR 19.3.6 contains an unquoted service path vulnerability that allows local attackers to execute code with elevated privileges during system startup. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will run with LocalSystem…
more
privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in BarcodeOCR directly enables path interception for local privilege escalation to LocalSystem via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for services, including proper quoting of executable paths to directly prevent unquoted service path exploitation.
Identifies, reports, and corrects system flaws like the unquoted service path in this CVE, remediating the vulnerability before exploitation.
Establishes and maintains a baseline configuration that excludes misconfigurations such as unquoted service paths, preventing deployment of vulnerable services.