CVE-2020-37230

Impact

Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the SMWebRestServicev5 service that allows local attackers to escalate privileges by exploiting the unquoted binary path. Attackers can insert a malicious executable into the service path and execute it with LocalSystem privileges when the service restarts or the system reboots.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://download.syncplify.me/SMServer_Setup.exe
• https://www.exploit-db.com/exploits/49009
• https://www.syncplify.me/
• https://www.vulncheck.com/advisories/syncplify-me-server-unquoted-service-path-privilege-escalation