CVE-2020-37058
Published: 30 January 2026
Summary
CVE-2020-37058 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Andreaelectronics (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37058 is an unquoted service path vulnerability in the Windows service configuration of Andrea ST Filters Service version 1.0.64.7. This flaw, classified under CWE-428, occurs when the service binary path lacks proper quotation, enabling unintended executable resolution during service startup.
Local attackers with low privileges can exploit this vulnerability by placing a malicious executable in a directory that the service search path traverses before reaching the legitimate binary. When the service starts, the injected code executes with elevated LocalSystem privileges, granting high confidentiality, integrity, and availability impact as reflected in its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Advisories and related resources include the vendor site at https://andreaelectronics.com/, a proof-of-concept exploit published on Exploit-DB at https://www.exploit-db.com/exploits/48396, and a VulnCheck advisory at https://www.vulncheck.com/advisories/andrea-st-filters-service-unquoted-service-path detailing the unquoted service path issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30956
Vulnerability details
Andrea ST Filters Service 1.0.64.7 contains an unquoted service path vulnerability in its Windows service configuration. Local attackers can exploit the unquoted path to inject malicious code that will execute with elevated LocalSystem privileges during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables path interception via unquoted service binary path (CWE-428), allowing low-priv local attacker to hijack execution flow with LocalSystem privileges on service start.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and correction of the specific unquoted service path flaw in Andrea ST Filters Service to prevent exploitation.
Establishes and enforces secure configuration settings for Windows services, including quoted executable paths and restricted write access to search path directories.
Applies least privilege to service accounts, limiting the damage from malicious code execution even if the unquoted path is exploited.