CVE-2020-37101
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2020-37101 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Vpnunlimitedapp (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2020-37101 is an unquoted service path vulnerability (CWE-428) in VPN Unlimited version 6.1. The flaw affects the Windows service binary path at 'C:\Program Files (x86)\VPN Unlimited\', where the lack of quotes around the path enables local attackers to inject malicious executables that the service will execute upon startup or restart.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction required (UI:N). By placing a malicious executable in an intermediate directory along the unquoted path, the attacker can trick the service into running it instead of the legitimate binary, resulting in elevated system privileges and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H).
Advisories and patches are detailed in referenced sources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/vpn-unlimited-unquoted-service-path, the vendor site at https://www.vpnunlimitedapp.com, and a proof-of-concept exploit at https://www.exploit-db.com/exploits/47916. Security practitioners should consult these for specific mitigation steps, such as updating to a patched version or applying service path hardening.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30975
Vulnerability Data
VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the service binary path. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\VPN Unlimited\' to replace the service executable and gain…
more
elevated system privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path to hijack Windows service execution for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of flaws like the unquoted service path in CVE-2020-37101 to prevent local privilege escalation.
Mandates establishment and enforcement of secure configuration settings, including properly quoting Windows service binary paths to eliminate unquoted path vulnerabilities.
Provides for vulnerability scanning that identifies configuration weaknesses such as unquoted service paths exploited in CVE-2020-37101.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent path-handling flaws such as unquoted elements during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect unquoted search-path issues before deployment.
Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.
Secure development lifecycle practices include input validation and path handling that reduce unquoted search-path weaknesses.
Secure system architecture and engineering principles require safe path construction and quoting conventions.
Secure coding standards directly mandate quoting search paths and avoiding unsafe path construction.
Change-management processes can enforce review of path-handling changes that might introduce unquoted elements.