CVE-2020-37048CWE-428

Iskysoft Application Framework Service 2.4.3.241 - 'IsAppService' Unquoted Service Path

High · published February 1, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
5.9
In the wild
Unconfirmed
What it is

⚡ An overlooked service path could let local users execute arbitrary code with elevated privileges—talk about being handed the keys to the kingdom! 🔑 Think of it like a restaurant where the chef has a secret ingredient stored in a cupboard that anyone can access. If someone sneaks in and swaps it out with something toxic, the entire kitchen—and all the customers—are in danger! With this unquoted service path vulnerability, a local attacker could inject malicious executables that run with the service's high-level system permissions. This could lead to full control over the system and allow them to carry out any malicious activities at will! The potential for damage is significant, and we absolutely don’t want to hand over that kind of power.

Put simply

Think of it like a restaurant where the chef has a secret ingredient stored in a cupboard that anyone can access. If someone sneaks in and swaps it out with something toxic, the entire kitchen—and all the customers—are in danger! The Iskysoft Application Framework Service version 2.4.3.241 has an unquoted service path that can be exploited by local users. This design flaw allows attackers to execute arbitrary code by placing malicious executables in the service path before it’s called.

What to do

With this unquoted service path vulnerability, a local attacker could inject malicious executables that run with the service's high-level system permissions. This could lead to full control over the system and allow them to carry out any malicious activities at will! The potential for damage is significant, and we absolutely don’t want to hand over that kind of power. To mitigate this risk, update the Iskysoft Application Framework Service to a version where this vulnerability is patched. Additionally, ensure that service paths have quotes around them to prevent similar exploits in the future. Regular audits of service configurations can help catch issues like this early! You've got this! Fixing this vulnerability will enhance your system's security and make you an internet security hero! 🦸

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00169 · 5.9th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2026-02-01T14:38Z
EPSS history
Timeline
  • 01 FEB 14:38Z
    Iskysoft Application Framework Service 2.4.3.241 - 'IsAppService' Unquoted Service Path
    cvelistv5