CVE-2016-20091: Windows Firewall Control Privilege Escalation

CVE-2016-20091 Overview

CVE-2016-20091 is an unquoted service path vulnerability affecting Windows Firewall Control version 4.8.6.0 from Binisoft. The wfcs.exe service is registered with an unquoted file path containing spaces, which Windows resolves by attempting executables at each space-delimited segment. A local attacker with write access to a directory along the resolution path can drop a malicious binary that Windows executes as LocalSystem when the service starts. This results in local privilege escalation from a standard user to SYSTEM. The flaw is tracked under CWE-428: Unquoted Search Path or Element.

Critical Impact
Successful exploitation grants LocalSystem privileges on hosts running Windows Firewall Control 4.8.6.0, enabling full host compromise from a low-privileged local account.

Affected Products

Binisoft Windows Firewall Control 4.8.6.0
The wfcs.exe Windows service component
Windows hosts where the product is installed in a path containing spaces

Discovery Timeline

2026-06-19 - CVE-2016-20091 published to the National Vulnerability Database
2026-06-22 - Last updated in the NVD database

Technical Details for CVE-2016-20091

Vulnerability Analysis

Windows Firewall Control 4.8.6.0 installs the wfcs.exe service with an unquoted ImagePath in the registry under HKLM\SYSTEM\CurrentControlSet\Services. When the Service Control Manager parses an unquoted path containing spaces, it tries each tokenized prefix as an executable. For example, a path such as C:\Program Files\Binisoft\Windows Firewall Control\wfcs.exe is searched in order as C:\Program.exe, C:\Program Files\Binisoft\Windows.exe, and so on. An attacker who can write to any of those intermediate directories can plant a payload that the SCM executes with the service account context. Because the service runs as LocalSystem, the planted binary inherits full administrative rights on the host.

Root Cause

The root cause is improper quoting of the service binary path during installation. The vendor did not wrap the ImagePath value in double quotes, leaving the service vulnerable to Windows path resolution ambiguity as described in CWE-428.

Attack Vector

Exploitation requires local access and write permissions to a directory in the unquoted path hierarchy. The attacker stages a malicious executable at a higher-priority path segment, then triggers a service restart or system reboot. On the next service start, Windows launches the planted binary as LocalSystem. Technical details and a proof of concept are published in Exploit-DB #40443 and the VulnCheck Advisory on Windows Firewall Control.

Detection Methods for CVE-2016-20091

Indicators of Compromise

Unexpected executables present at paths such as C:\Program.exe or within parent directories of wfcs.exe.
New SYSTEM-owned processes spawned as children of services.exe that do not match the legitimate wfcs.exe binary hash or signature.
Creation of files in C:\Program Files\Binisoft\ or its parents by non-administrative users.

Detection Strategies

Enumerate service ImagePath values and flag entries that contain spaces but are not wrapped in double quotes.
Audit directory ACLs along the unquoted path for write permissions granted to standard users or Authenticated Users.
Correlate Windows Service Control Manager events (Event ID 7045, 7036) with unexpected binary launches under the SYSTEM account.

Monitoring Recommendations

Enable process creation auditing (Event ID 4688) with command-line logging to capture parent-child relationships for SYSTEM processes.
Monitor file writes to root drive locations such as C:\ and C:\Program Files\ by non-privileged accounts.
Alert on registry modifications to HKLM\SYSTEM\CurrentControlSet\Services\wfcs\ImagePath.

How to Mitigate CVE-2016-20091

Immediate Actions Required

Inventory hosts running Windows Firewall Control 4.8.6.0 and upgrade to a patched release from the Binisoft Official Site.
Manually quote the ImagePath value for the wfcs service in the registry until the product is upgraded.
Restrict write permissions on C:\ and intermediate Program Files directories to administrators only.

Patch Information

Vendor updates are distributed through the Binisoft Official Site. Administrators should validate the installed service path after upgrade to confirm the ImagePath registry value is enclosed in double quotes.

Workarounds

Edit the registry value HKLM\SYSTEM\CurrentControlSet\Services\wfcs\ImagePath to wrap the executable path in double quotes, then restart the service.
Remove write permissions for non-administrative principals from all directories along the unquoted path.
Apply application allowlisting to prevent execution of unsigned binaries from non-standard locations such as C:\Program.exe.

bash

# Configuration example
# Inspect the service ImagePath for unquoted paths
sc qc wfcs

# Re-register the service with a properly quoted binary path
sc config wfcs binPath= "\"C:\Program Files\Binisoft\Windows Firewall Control\wfcs.exe\""