CVE-2020-37101
Published: 03 February 2026
Summary
CVE-2020-37101 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Vpnunlimitedapp (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 1.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37101 is an unquoted service path vulnerability (CWE-428) in VPN Unlimited version 6.1. The flaw affects the Windows service binary path at 'C:\Program Files (x86)\VPN Unlimited\', where the lack of quotes around the path enables local attackers to inject malicious executables that the service will execute upon startup or restart.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction required (UI:N). By placing a malicious executable in an intermediate directory along the unquoted path, the attacker can trick the service into running it instead of the legitimate binary, resulting in elevated system privileges and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H).
Advisories and patches are detailed in referenced sources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/vpn-unlimited-unquoted-service-path, the vendor site at https://www.vpnunlimitedapp.com, and a proof-of-concept exploit at https://www.exploit-db.com/exploits/47916. Security practitioners should consult these for specific mitigation steps, such as updating to a patched version or applying service path hardening.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30975
Vulnerability details
VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the service binary path. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\VPN Unlimited\' to replace the service executable and gain…
more
elevated system privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path to hijack Windows service execution for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of flaws like the unquoted service path in CVE-2020-37101 to prevent local privilege escalation.
Mandates establishment and enforcement of secure configuration settings, including properly quoting Windows service binary paths to eliminate unquoted path vulnerabilities.
Provides for vulnerability scanning that identifies configuration weaknesses such as unquoted service paths exploited in CVE-2020-37101.