CVE-2020-37017
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2020-37017 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wibu (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2020-37017 is an unquoted service path vulnerability (CWE-428) affecting CodeMeter version 6.60, specifically in the CodeMeter Runtime Server service. This flaw arises from an unquoted binary path in the service configuration, which can allow local users to execute arbitrary code with elevated system privileges, such as LocalSystem permissions. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact but requiring local access.
Local low-privileged users can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate CodeMeter binary path in the system's search order. Successful exploitation would allow the attacker to inject and execute arbitrary code under the elevated privileges of the CodeMeter Runtime Server service, potentially leading to full system compromise on affected Windows systems.
Advisories and resources, including those from Vulncheck detailing the unquoted path in CodeMeter.exe and a proof-of-concept exploit on Exploit-DB, highlight the issue, while Wibu's CodeMeter Runtime product page provides context on the affected component. No specific patch details are outlined in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30921
Vulnerability Data
CodeMeter 6.60 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the CodeMeter Runtime Server service to inject malicious code that would…
more
execute with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path enabling path interception for privilege escalation via malicious executable placement in search order.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
CM-6 enforces secure configuration settings for system services, directly mitigating unquoted service path vulnerabilities by requiring properly quoted executable paths.
SI-2 mandates timely remediation of identified flaws, such as applying patches or fixes for the unquoted path in CodeMeter Runtime Server service.
CM-10 implements software usage restrictions like allowlisting, preventing execution of malicious binaries placed to exploit the unquoted service path.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent path-handling flaws such as unquoted elements during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect unquoted search-path issues before deployment.
Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.
Secure development lifecycle practices include input validation and path handling that reduce unquoted search-path weaknesses.
Secure system architecture and engineering principles require safe path construction and quoting conventions.
Secure coding standards directly mandate quoting search paths and avoiding unsafe path construction.
Change-management processes can enforce review of path-handling changes that might introduce unquoted elements.