CVE-2020-37253CWE-428

CVE-2020-37253

High · published June 19, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

Winstep 18.06.0096 contains an unquoted service path vulnerability in the Winstep Xtreme Service that allows local attackers to escalate privileges. Attackers can place malicious executables in the Program Files directory to be executed with LocalSystem privileges when the service starts.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00157 · 4.5th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2026-06-19T19:16Z
References (2)
https://www.exploit-db.com/exploits/49004 · [email protected]https://www.vulncheck.com/advisories/winstep-unquoted-service-path-privilege-escalation · [email protected]
EPSS history
Timeline
  • 19 JUN 14:16Z
    Winstep 18.06.0096 Unquoted Service Path Privilege Escalation
    cvelistv5