CVE-2020-37098
Published: 03 February 2026
Summary
CVE-2020-37098 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Disksorter (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37098 is an unquoted service path vulnerability affecting Disk Sorter Enterprise version 12.4.16. The issue, classified under CWE-428, arises from an improperly quoted executable path in the service configuration, enabling local attackers to execute arbitrary code with elevated system privileges. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-03.
Local low-privileged attackers can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's search path. When the service starts or restarts, the injected executable runs with LocalSystem permissions, granting the attacker high-impact control over confidentiality, integrity, and availability on the affected system.
Advisories and references, including those from VulnCheck and the vendor site at http://www.disksorter.com, provide details on the issue, while a proof-of-concept exploit is available at https://www.exploit-db.com/exploits/48048. Security practitioners should review these sources for recommended mitigations, such as applying patches if available or implementing service path quoting best practices.
An exploit PoC on Exploit-DB indicates practical exploitability, though no widespread real-world exploitation has been detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30978
Vulnerability details
Disk Sorter Enterprise 12.4.16 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched…
more
with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service config directly matches Path Interception by Unquoted Path, enabling local privilege escalation via malicious binary placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings including properly quoted executable paths for services, directly preventing exploitation of unquoted service path vulnerabilities like CVE-2020-37098.
Requires timely identification, reporting, and correction of flaws such as CVE-2020-37098 through patching or configuration fixes, eliminating the vulnerability.
Mandates least privilege for system processes including services, reducing the impact of privilege escalation if an unquoted service path is exploited.