CVE-2020-37060
Published: 30 January 2026
Summary
CVE-2020-37060 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Drive Software (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37060 is a local privilege escalation vulnerability in Atomic Alarm Clock 6.3, stemming from an unquoted service path in its service configuration (CWE-428). This flaw enables attackers to execute arbitrary code with SYSTEM privileges. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H) and was published on 2026-01-30.
Local attackers with low privileges can exploit the unquoted service path by placing a malicious executable named 'Program.exe' in a specific directory, causing the service to execute it instead of the legitimate binary upon startup. This achieves arbitrary code execution with SYSTEM privileges, enabling persistent system-level access.
Advisories, including those from VulnCheck and an Exploit-DB entry (48352), detail the unquoted service path issue in Atomic Alarm Clock. The vendor site is available at drive-software.com.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30954
Vulnerability details
Atomic Alarm Clock 6.3 contains a local privilege escalation vulnerability in its service configuration that allows attackers to execute arbitrary code with SYSTEM privileges. Attackers can exploit the unquoted service path by placing a malicious executable named 'Program.exe' to gain…
more
persistent system-level access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception for privilege escalation to SYSTEM via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of flaws like CVE-2020-37060, including patching the unquoted service path or removing the vulnerable service.
Mandates secure configuration settings for system components, ensuring service executable paths are quoted and parent directories are protected from unauthorized writes.
Enforces least privilege for accounts and processes, allowing the service to run with minimal necessary privileges to reduce the impact of escalation to SYSTEM.