vulnwire
7.8high

CVE-2016-20057

NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation

Published 7 mo ago · modified 11 d ago · JSON

CVSS
7.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 50%
Public exploits
0
none known

NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the unquoted path and trigger service restart or system reboot to execute code with LocalSystem privileges.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction (EPSS)

0.62% probability of exploitation in the next 30 days, higher than 50% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.08.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA4.08.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Netgate NETGATE Registry Cleaner

Classification

Weakness
  • CWE-428 Unquoted Search Path or Element

References

  • exploit-db.com /exploits/40539 · exploit
  • netgate.sk / · product
  • netgate.sk /download/download.php?id=4 · product
  • vulncheck.com /advisories/netgate-registry-cleaner-build-unquoted-service-path-privilege-escalation · third-party-advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.