CVE-2016-20091

Name of the Vulnerable Software and Affected Versions Windows Firewall Control version 4.8.6.0

Description An unquoted service path issue exists where the wfcs.exe service is configured with a path containing spaces that is not enclosed in quotes. This allows a local attacker to escalate privileges by placing a malicious executable file within the unquoted directories of the service path. Upon a system reboot or service restart, the service will execute the malicious file with LocalSystem privileges.

Recommendations Update Windows Firewall Control to a version where the service path for wfcs.exe is properly quoted.