CVE-2020-37098

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2020-37098 is an unquoted service path vulnerability affecting Disk Sorter Enterprise version 12.4.16. The issue, classified under CWE-428, arises from an improperly quoted executable path in the service configuration, enabling local attackers to execute arbitrary code with elevated system privileges. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-03.

Local low-privileged attackers can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's search path. When the service starts or restarts, the injected executable runs with LocalSystem permissions, granting the attacker high-impact control over confidentiality, integrity, and availability on the affected system.

Advisories and references, including those from VulnCheck and the vendor site at http://www.disksorter.com, provide details on the issue, while a proof-of-concept exploit is available at https://www.exploit-db.com/exploits/48048. Security practitioners should review these sources for recommended mitigations, such as applying patches if available or implementing service path quoting best practices.

An exploit PoC on Exploit-DB indicates practical exploitability, though no widespread real-world exploitation has been detailed in the provided information.