CVE-2020-37251CWE-428

CVE-2020-37251

High · published June 19, 2026

CVSS v3.1

7.8

EPSS

Percentile

6.5

In the wild

Unconfirmed

What it is

RealTimes Desktop Service 18.1.4 contains an unquoted service path vulnerability in the rpdsvc.exe binary that allows local attackers to escalate privileges. Attackers can place malicious executables in unquoted path directories to execute arbitrary code with LocalSystem privileges during service startup or system reboot.

The record

Technical detail

CVSS v3.1: 7.8 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00173 · 6.5th percentile
Weakness: CWE-428 · Unquoted Search Path or Element
Published: 2026-06-19T19:16Z

References (3)

https://www.exploit-db.com/exploits/49021 · [email protected]https://www.real.com/ · [email protected]https://www.vulncheck.com/advisories/realtimes-desktop-service-unquoted-service-path-privilege-escalation · [email protected]

EPSS history

Timeline

19 JUN 14:16Z
RealTimes Desktop Service 18.1.4 Unquoted Service Path Privilege Escalation
cvelistv5