CVE-2016-20058: Netgate AMITI Antivirus Escalation Flaw

CVE-2016-20058 Overview

CVE-2016-20058 is an unquoted service path vulnerability affecting Netgate AMITI Antivirus build 23.0.305. The AmitiAvSrv and AmitiAntivirusHealth services contain unquoted service paths that allow local attackers to escalate privileges. By placing a malicious executable in the unquoted service path, attackers can trigger code execution with LocalSystem privileges when the service restarts or the system reboots.

Critical Impact

Local privilege escalation to LocalSystem through unquoted service path exploitation in antivirus software services.

Affected Products

• Netgate AMITI Antivirus build 23.0.305
• AmitiAvSrv service
• AmitiAntivirusHealth service

Discovery Timeline

• 2026-04-04 - CVE-2016-20058 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2016-20058

Vulnerability Analysis

This vulnerability is classified under CWE-428 (Unquoted Search Path or Element). The issue arises from improper configuration of Windows service paths in Netgate AMITI Antivirus. When Windows service paths contain spaces and are not enclosed in quotation marks, the operating system attempts to locate executables by parsing the path at each space character. This behavior creates an opportunity for attackers to place malicious executables in intermediate directory locations that Windows will execute before reaching the intended service binary.

The affected services, AmitiAvSrv and AmitiAntivirusHealth, run with LocalSystem privileges, which is the highest privilege level on Windows systems. Successful exploitation grants the attacker complete control over the affected system, including the ability to access all files, modify system configurations, and install persistent backdoors.

Root Cause

The root cause of this vulnerability is the failure to properly quote service executable paths in the Windows registry during the software installation process. When the service paths contain spaces (common in paths like C:\Program Files\...), Windows service path parsing logic interprets the path ambiguously without proper quotation marks. The installation routine for Netgate AMITI Antivirus did not follow secure coding practices by enclosing the service binary path in double quotes.

Attack Vector

The attack vector requires local access to the system with write permissions to one of the directories in the unquoted path hierarchy. An attacker with limited user privileges can place a malicious executable at a strategic location within the unquoted path (such as C:\Program.exe or similar). When the vulnerable service is started—either manually, through a system reboot, or via service restart—Windows will execute the attacker's malicious binary with LocalSystem privileges instead of the legitimate antivirus service executable.

The exploitation is straightforward: identify the unquoted service path, determine a writable location within the path hierarchy, drop a malicious payload, and wait for or trigger a service restart.

Detection Methods for CVE-2016-20058

Indicators of Compromise

• Unexpected executable files in C:\Program Files parent directories (e.g., C:\Program.exe, C:\Program Files\Netgate.exe)
• Suspicious processes spawning with SYSTEM privileges from non-standard locations
• Unauthorized modifications to service registry entries under HKLM\SYSTEM\CurrentControlSet\Services

Detection Strategies

• Utilize Windows Event Log monitoring for service start events (Event ID 7000, 7045) involving the AmitiAvSrv or AmitiAntivirusHealth services
• Deploy file integrity monitoring on directories commonly targeted by unquoted service path exploits
• Use PowerShell or WMIC commands to enumerate services with unquoted paths: wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """"

Monitoring Recommendations

• Implement endpoint detection and response (EDR) solutions to monitor for privilege escalation attempts
• Configure SentinelOne behavioral AI to detect suspicious process execution chains originating from writable directories
• Monitor for new executable files being created in root drive directories or Program Files parent paths

How to Mitigate CVE-2016-20058

Immediate Actions Required

• Audit the affected service registry entries and manually add quotation marks around the service executable paths
• Remove or quarantine any suspicious executables found in parent directories of the service path
• Restrict write permissions on directories that could be exploited (e.g., C:\, C:\Program Files\Netgate\)

Patch Information

Users should check the Netgate Official Website for updated versions of AMITI Antivirus that address this vulnerability. The Netgate Download Resource page may contain newer builds with the fix applied. For technical details on the vulnerability, refer to the VulnCheck Advisory: Netgate Amiti Escalation and Exploit-DB #40540.

Workarounds

• Manually correct the service path by adding quotation marks in the Windows registry (HKLM\SYSTEM\CurrentControlSet\Services\AmitiAvSrv and AmitiAntivirusHealth)
• Implement application whitelisting to prevent unauthorized executables from running
• Use least privilege principles to limit which users can write to directories in the service path hierarchy

# Registry fix example (run as Administrator in cmd.exe)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\AmitiAvSrv" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Netgate\Amiti Antivirus\AmitiAvSrv.exe\"" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\AmitiAntivirusHealth" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Netgate\Amiti Antivirus\AmitiAntivirusHealth.exe\"" /f