CVE-2020-37253

Name of the Vulnerable Software and Affected Versions Winstep version 18.06.0096

Description The Winstep Xtreme Service contains an unquoted service path issue. This occurs when a service path contains spaces and is not enclosed in quotes, allowing a local attacker to place a malicious executable in the directory path to achieve privilege escalation. In this case, an attacker can place a file in the Program Files directory to be executed with LocalSystem privileges upon service startup.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.