CVE-2020-36938CWE-732

WinAVR Version 20100110 - Insecure Folder Permissions

High · published January 27, 2026

CVSS v4.0
7.0
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

⚡ An authenticated user could tweak system files with a simple command! This insecure permissions flaw in WinAVR unlocks access to sensitive DLLs and executables like a VIP pass to the backstage area. 🎟️ Think of it as a restaurant where every server has the keys to the kitchen. If one of them decides to change the recipe for the chef's signature dish without permission, the whole experience can go south fast! If an attacker gains access, they could modify critical system files, potentially leading to malware installation, service disruptions, or even taking complete control of the application. Imagine a malicious chef serving up harmful dishes that could poison the entire menu — that’s the level of risk we're facing!

Put simply

Think of it as a restaurant where every server has the keys to the kitchen. If one of them decides to change the recipe for the chef's signature dish without permission, the whole experience can go south fast! WinAVR version 20100110 has overly permissive access controls, allowing authenticated users to modify critical files in the installation directory, including executables and DLLs, without proper authorization checks.

What to do

If an attacker gains access, they could modify critical system files, potentially leading to malware installation, service disruptions, or even taking complete control of the application. Imagine a malicious chef serving up harmful dishes that could poison the entire menu — that’s the level of risk we're facing! To protect your system, immediately apply the latest update to WinAVR or review your user permissions to restrict access to sensitive directories. Ensure that only trusted users have the necessary permissions to modify system files. 🛡️ You've got this! By tightening permissions, you can secure your system and keep those rogue recipes off the menu! 🍽️✨

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00230 · 13.0th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-01-27T15:23Z
EPSS history
Timeline
  • 27 JAN 15:23Z
    WinAVR Version 20100110 - Insecure Folder Permissions
    cvelistv5