7.8high
CVE-2016-20091
Windows Firewall Control 4.8.6.0 Unquoted Service Path Privilege Escalation
Published 4 mo ago · modified 39 d ago · JSON
CVSS
7.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 6%
Public exploits
0
none known
Summary
Windows Firewall Control 4.8.6.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by inserting malicious executables in the service path. Attackers can place executable files in unquoted path directories that the wfcs.exe service will execute with LocalSystem privileges upon service restart or system reboot.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction (EPSS)
0.17% probability of exploitation in the next 30 days, higher than 6% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Binisoft Windows Firewall Control
Classification
- Weakness
- CWE-428 Unquoted Search Path or Element
References
- exploit-db.com /exploits/40443 · exploit
- binisoft.org · product
- vulncheck.com /advisories/windows-firewall-control-unquoted-service-path-privilege-escalation · third-party-advisory
Sources
- CVE List: CVE-2016-20091
- NVD: CVE-2016-20091
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.