CVE-2016-20092: NetDrive 2.6.12 Privilege Escalation Flaw

CVE-2016-20092 Overview

CVE-2016-20092 is an unquoted service path vulnerability in NetDrive 2.6.12. The Netdrive2_Service_Netdrive2 Windows service installs with a path that contains spaces but lacks surrounding quotation marks. Local attackers with write access to a parent directory in the service path can place a malicious executable that Windows loads at service startup. Successful exploitation runs attacker-supplied code with NT AUTHORITY\SYSTEM privileges, producing a local privilege escalation. The weakness is classified under [CWE-428: Unquoted Search Path or Element].

Critical Impact
A low-privileged local user can gain SYSTEM-level code execution at service start or system reboot, fully compromising the affected Windows host.

Affected Products

NetDrive 2.6.12 for Windows
The Windows service Netdrive2_Service_Netdrive2 installed by NetDrive 2
Earlier NetDrive 2.x builds that ship the same unquoted service registration

Discovery Timeline

2026-06-19 - CVE-2016-20092 published to the National Vulnerability Database (NVD)
2026-06-23 - CVE-2016-20092 record last modified in NVD

Technical Details for CVE-2016-20092

Vulnerability Analysis

NetDrive 2.6.12 registers a Windows service whose ImagePath value in the registry contains spaces but no quotation marks. When the Service Control Manager (SCM) starts an unquoted path that contains spaces, Windows tokenizes the path on each whitespace boundary and attempts to execute each candidate in turn. An attacker who can write to any directory along the resolution chain can drop a binary that Windows will load before the legitimate NetDrive executable. The flaw is local in nature and requires only low privileges, but it bridges the gap between a standard user account and SYSTEM, which is the highest local trust level on Windows.

Root Cause

The root cause is improper quoting of the service binary path during installation. The installer writes the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\Netdrive2_Service_Netdrive2 without wrapping the full path in quotes. Windows then applies its documented fallback parsing rules and searches for executables at each truncated prefix of the path.

Attack Vector

An authenticated local user identifies the unquoted path with wmic service get name,pathname,startmode or sc qc Netdrive2_Service_Netdrive2. The attacker then writes a malicious executable to a directory earlier in the resolution chain, such as C:\Program.exe, when filesystem permissions permit. At the next service start or system reboot, the SCM executes the planted binary in the SYSTEM security context. Further technical detail is available in the Exploit-DB entry #40422 and the VulnCheck advisory.

Detection Methods for CVE-2016-20092

Indicators of Compromise

Unexpected executables in root-level directories such as C:\Program.exe or C:\Program Files\Bdrive.exe that match the prefix of the NetDrive service path.
New SYSTEM-owned processes spawned by services.exe whose image path does not match the legitimate NetDrive installation directory.
File creation events in directories writable by standard users that align with truncated boundaries of the unquoted service path.

Detection Strategies

Enumerate Windows services and flag any ImagePath value that contains a space and is not enclosed in quotation marks.
Audit child processes of services.exe and alert when the executable lives outside expected vendor installation paths.
Monitor for writes by non-administrative users to drive roots and to C:\Program Files prefixes that resolve to unquoted service paths.

Monitoring Recommendations

Enable Windows Security event ID 4697 (service install) and 7045 (new service) collection to detect tampering with the Netdrive2_Service_Netdrive2 configuration.
Forward Sysmon Event ID 1 (process create) and Event ID 11 (file create) to a centralized log platform and correlate planted binaries with subsequent SYSTEM process executions.
Periodically re-scan endpoints for unquoted service paths after any third-party software install, since the issue often reappears with vendor updates.

How to Mitigate CVE-2016-20092

Immediate Actions Required

Inventory hosts running NetDrive 2.6.12 and identify the Netdrive2_Service_Netdrive2 service on each system.
Manually quote the ImagePath registry value for the affected service until a vendor-supplied fix is applied.
Restrict write permissions on C:\ and C:\Program Files so that standard users cannot drop executables that intercept the service path.
Remove or upgrade NetDrive 2.6.12 where the application is no longer required.

Patch Information

No vendor patch is referenced in the NVD record for CVE-2016-20092. Review the NetDrive download page for the latest available release and confirm that the installed service path is properly quoted after upgrade. Consult the VulnCheck advisory on NetDrive for additional remediation guidance.

Workarounds

Edit HKLM\SYSTEM\CurrentControlSet\Services\Netdrive2_Service_Netdrive2\ImagePath and wrap the full executable path in double quotes, then restart the service.
Apply NTFS access control lists that deny standard users the Create Files and Create Folders rights on C:\ and on any directory that prefixes the service binary path.
Disable the Netdrive2_Service_Netdrive2 service on systems where NetDrive functionality is not needed.

bash

# Configuration example: quote the service ImagePath via reg.exe (run as Administrator)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Netdrive2_Service_Netdrive2" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Bdrive\Netdrive2_Service.exe\"" /f
sc stop Netdrive2_Service_Netdrive2
sc start Netdrive2_Service_Netdrive2