Cyber Resilience

CVE-2020-37060

HighPublic PoC

Published: 30 January 2026

Published
30 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0016 5.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2020-37060 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Drive Software (inferred from references). Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2020-37060 is a local privilege escalation vulnerability in Atomic Alarm Clock 6.3, stemming from an unquoted service path in its service configuration (CWE-428). This flaw enables attackers to execute arbitrary code with SYSTEM privileges. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H) and was published on 2026-01-30.

Local attackers with low privileges can exploit the unquoted service path by placing a malicious executable named 'Program.exe' in a specific directory, causing the service to execute it instead of the legitimate binary upon startup. This achieves arbitrary code execution with SYSTEM privileges, enabling persistent system-level access.

Advisories, including those from VulnCheck and an Exploit-DB entry (48352), detail the unquoted service path issue in Atomic Alarm Clock. The vendor site is available at drive-software.com.

EU & UK References

Vulnerability details

Atomic Alarm Clock 6.3 contains a local privilege escalation vulnerability in its service configuration that allows attackers to execute arbitrary code with SYSTEM privileges. Attackers can exploit the unquoted service path by placing a malicious executable named 'Program.exe' to gain…

more

persistent system-level access.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1574.009 Path Interception by Unquoted Path Stealth
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Unquoted service path (CWE-428) directly enables path interception for privilege escalation to SYSTEM via malicious executable placement.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2022-50914Shared CWE-428
CVE-2020-36982Shared CWE-428
CVE-2020-36987Shared CWE-428
CVE-2021-47825Shared CWE-428
CVE-2020-37059Shared CWE-428
CVE-2020-36953Shared CWE-428
CVE-2022-50935Shared CWE-428
CVE-2021-47864Shared CWE-428
CVE-2019-25308Shared CWE-428
CVE-2021-47845Shared CWE-428

Affected Assets

Drive Software
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires identification, reporting, and correction of flaws like CVE-2020-37060, including patching the unquoted service path or removing the vulnerable service.

prevent

Mandates secure configuration settings for system components, ensuring service executable paths are quoted and parent directories are protected from unauthorized writes.

prevent

Enforces least privilege for accounts and processes, allowing the service to run with minimal necessary privileges to reduce the impact of escalation to SYSTEM.

References