CVE-2020-37017
Published: 29 January 2026
Summary
CVE-2020-37017 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wibu (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2020-37017 is an unquoted service path vulnerability (CWE-428) affecting CodeMeter version 6.60, specifically in the CodeMeter Runtime Server service. This flaw arises from an unquoted binary path in the service configuration, which can allow local users to execute arbitrary code with elevated system privileges, such as LocalSystem permissions. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact but requiring local access.
Local low-privileged users can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate CodeMeter binary path in the system's search order. Successful exploitation would allow the attacker to inject and execute arbitrary code under the elevated privileges of the CodeMeter Runtime Server service, potentially leading to full system compromise on affected Windows systems.
Advisories and resources, including those from Vulncheck detailing the unquoted path in CodeMeter.exe and a proof-of-concept exploit on Exploit-DB, highlight the issue, while Wibu's CodeMeter Runtime product page provides context on the affected component. No specific patch details are outlined in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30921
Vulnerability details
CodeMeter 6.60 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the CodeMeter Runtime Server service to inject malicious code that would…
more
execute with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path enabling path interception for privilege escalation via malicious executable placement in search order.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
CM-6 enforces secure configuration settings for system services, directly mitigating unquoted service path vulnerabilities by requiring properly quoted executable paths.
SI-2 mandates timely remediation of identified flaws, such as applying patches or fixes for the unquoted path in CodeMeter Runtime Server service.
CM-10 implements software usage restrictions like allowlisting, preventing execution of malicious binaries placed to exploit the unquoted service path.