CVE-2020-37250CWE-428

CVE-2020-37250

High · published June 19, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
6.5
In the wild
Unconfirmed
What it is

TFTP Broadband 4.3.0.1465 contains an unquoted service path vulnerability in the tftpt.exe service binary that allows local attackers to execute arbitrary code with system privileges. Attackers can place a malicious executable in the Program Files directory path that will be executed during service startup or system reboot with LocalSystem privileges.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00173 · 6.5th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2026-06-19T19:16Z
References (3)
https://www.exploit-db.com/exploits/49852 · [email protected]https://www.vulncheck.com/advisories/tftp-broadband-unquoted-service-path-privilege-escalation · [email protected]https://www.weird-solutions.com · [email protected]
EPSS history
Timeline
  • 19 JUN 14:16Z
    TFTP Broadband 4.3.0.1465 Unquoted Service Path Privilege Escalation
    cvelistv5