CVE-2016-20089 Overview
CVE-2016-20089 is an unquoted service path vulnerability in Iperius Remote 1.7.0, a Windows remote support and remote desktop application. The flaw exists because the installer registers a Windows service without enclosing the executable path in quotation marks. When the service binary is installed under a directory containing spaces, Windows attempts to resolve each space-delimited token as a potential executable. A local user with write access to an intermediate directory can place a malicious binary that executes with SYSTEM privileges at service start or system reboot. This issue is classified under [CWE-428: Unquoted Search Path or Element].
Critical Impact
Local attackers can achieve SYSTEM-level code execution by planting a binary in an unquoted service path, leading to full host compromise.
Affected Products
- Iperius Remote 1.7.0 for Windows
- Installations deployed to directory paths containing spaces
- Hosts where the Iperius Remote service runs with the LocalSystem account
Discovery Timeline
- 2026-06-19 - CVE-2016-20089 published to the National Vulnerability Database
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2016-20089
Vulnerability Analysis
The vulnerability stems from how the Iperius Remote installer registers its Windows service binary path in the Service Control Manager (SCM). The ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\ is written without surrounding quotation marks. Windows resolves unquoted paths by splitting the string at each space character and probing every prefix as a candidate executable. An attacker who can write to any intermediate directory along the resolution chain can place a crafted executable that Windows will launch instead of the legitimate service binary.
Because the Iperius Remote service runs as LocalSystem, the planted binary inherits SYSTEM privileges. This converts a low-privileged local foothold into full administrative control of the host. The Exploit-DB entry 40427 documents the path resolution behavior on affected installations.
Root Cause
The root cause is improper neutralization of whitespace in a service registration string. The installer does not wrap the service executable path in double quotes before passing it to the SCM. Windows treats spaces as argument separators, leading the loader to test multiple file names before reaching the intended binary.
Attack Vector
Exploitation requires local access with permission to write a binary into an unquoted path component. The attacker drops a malicious executable named to match the first space-delimited token of the path. On the next service start or system reboot, the SCM invokes the planted binary as SYSTEM. No user interaction is required beyond the service lifecycle event. Refer to the VulnCheck Iperius Remote Advisory for the full technical write-up.
Detection Methods for CVE-2016-20089
Indicators of Compromise
- Unexpected executables in root or intermediate directories along the Iperius Remote installation path, particularly files matching the first whitespace-delimited token of the service ImagePath.
- New child processes spawned by services.exe whose image path differs from the legitimate Iperius Remote service binary.
- Service start events (Windows Event ID 7036) for Iperius Remote followed by anomalous SYSTEM-context process creation.
Detection Strategies
- Enumerate Windows services and flag any ImagePath value containing a space without surrounding double quotes using wmic service get name,pathname,startmode.
- Audit file system Access Control Lists (ACLs) on every directory in the service resolution chain for write permissions granted to non-administrative users.
- Correlate Sysmon Event ID 1 (process creation) entries where the parent is services.exe and the image path resides outside the expected installation directory.
Monitoring Recommendations
- Alert on file write operations targeting root drives or intermediate directories that match unquoted service path tokens.
- Monitor changes to the HKLM\SYSTEM\CurrentControlSet\Services\ registry hive, especially modifications to ImagePath values.
- Track service installation and modification events across the fleet for baseline deviations.
How to Mitigate CVE-2016-20089
Immediate Actions Required
- Inventory all hosts running Iperius Remote 1.7.0 and identify installations whose service path contains spaces.
- Restrict write permissions on root drives and any intermediate directories within the service resolution chain to administrators only.
- Manually quote the service ImagePath registry value to neutralize the path-splitting behavior until an upgrade is applied.
Patch Information
Upgrade Iperius Remote to a current release available from the Iperius Remote Download Page. Reinstall the product to a path without spaces, or to a location where the installer registers a quoted service path. Validate the post-installation ImagePath value to confirm the fix.
Workarounds
- Edit the service registration with sc config "<ServiceName>" binPath= "\"C:\Program Files\Iperius Remote\service.exe\"" to enforce quoting.
- Reinstall Iperius Remote into a path without whitespace, such as C:\IperiusRemote\, to eliminate ambiguous tokens.
- Apply NTFS deny-write ACLs on C:\ and C:\Program Files\ for standard users to block placement of malicious binaries.
# Configuration example: quote the service binary path
sc config "IperiusRemote" binPath= "\"C:\Program Files\Iperius Remote\IperiusRemote.exe\""
sc qc "IperiusRemote"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
