CVE-2020-37223CWE-428

IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation

High · published May 13, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTEM level. Attackers can place a malicious executable named IObit.exe in the C:\Program Files (x86)\IObit directory and restart the service to execute code with SYSTEM privileges.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00120 · 1.7th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2026-05-13T14:22Z
EPSS history
Timeline
  • 13 MAY 14:22Z
    IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation
    cvelistv5