CVE-2020-37063
Published: 01 February 2026
Summary
CVE-2020-37063 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Weird Solutions (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2020-37063 is an unquoted service path vulnerability (CWE-428) affecting TFTP Turbo version 4.6.1273. The flaw exists in the Windows service configuration, where the ImagePath registry value lacks proper quoting, enabling local privilege escalation.
A local attacker with low privileges (PR:L) can exploit this by placing a malicious executable in a directory that precedes the legitimate service binary in the system's PATH search order. When the TFTP Turbo service starts or restarts, it executes the attacker's binary instead, granting LocalSystem permissions and allowing arbitrary code execution with full system access. The CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) underscores the high confidentiality, integrity, and availability impacts.
Advisories, including those from VulnCheck (https://www.vulncheck.com/advisories/tftp-turbo-tftp-turbo-unquoted-service-path) and an Exploit-DB proof-of-concept (https://www.exploit-db.com/exploits/48085), detail the vulnerability and exploitation. The vendor site (https://www.weird-solutions.com) provides additional context; practitioners should consult these for patching instructions or service reconfiguration to quote the path properly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30966
Vulnerability details
TFTP Turbo 4.6.1273 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched with…
more
LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted ImagePath in Windows service directly matches Path Interception by Unquoted Path (T1574.009) for local execution hijack; results in privilege escalation to LocalSystem (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires secure configuration settings for system components, including properly quoted executable paths in Windows service registry entries to directly prevent exploitation of unquoted service path vulnerabilities like CVE-2020-37063.
Mandates timely identification, reporting, and correction of flaws such as the unquoted service path in TFTP Turbo, mitigating CVE-2020-37063 through patching or reconfiguration.
Provides for vulnerability scanning that identifies unquoted service path configurations exploited by CVE-2020-37063, enabling proactive detection and remediation.