Cyber Resilience

CVE-2020-37247

HighPublic PoC

Published: 16 May 2026

Published
16 May 2026
Modified
18 May 2026
KEV Added
—
Patch
—
CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0011 1.8th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2020-37247 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Kite (inferred from references). Its CVSS base score is 8.5 (High).

Operationally, ranked at the 1.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the Program Files directory to be…

more

executed with LocalSystem privileges when the service starts.

CWE(s)
CWE-428

Related Threats

CVEs Like This One

CVE-2020-36928Shared CWE-428
CVE-2023-54336Shared CWE-428
CVE-2020-37048Shared CWE-428
CVE-2019-25306Shared CWE-428
CVE-2020-36979Shared CWE-428
CVE-2024-57276Shared CWE-428
CVE-2022-50914Shared CWE-428
CVE-2020-36929Shared CWE-428
CVE-2020-37017Shared CWE-428
CVE-2020-36982Shared CWE-428

Affected Assets

Kite
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References