CVE-2016-20093: Wise Care 365 Privilege Escalation Flaw

CVE-2016-20093 Overview

CVE-2016-20093 affects Wise Care 365 version 4.27 and Wise Disk Cleaner version 9.29 on Windows systems. Both applications register Windows services with unquoted file paths, classified under [CWE-428]. The flaw exists in the WiseBootAssistant service shipped with Wise Care 365 and the SpyHunter 4 Service distributed with Wise Disk Cleaner. A local authenticated attacker can place a malicious executable in the system root and gain SYSTEM privileges when the service starts or the host reboots.

Critical Impact
Local low-privileged users can execute arbitrary code as SYSTEM by planting an executable along an unquoted service path, resulting in full host compromise.

Affected Products

Wise Care 365 version 4.27 (WiseBootAssistant service)
Wise Disk Cleaner version 9.29 (SpyHunter 4 Service)
Windows hosts where either product is installed under a path containing spaces

Discovery Timeline

2026-06-19 - CVE-2016-20093 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2016-20093

Vulnerability Analysis

Windows resolves service ImagePath values by parsing the string token by token when the path is not enclosed in quotation marks. When an installer registers a service with a path such as C:\Program Files\Vendor\Sub Dir\service.exe, Windows attempts to execute C:\Program.exe, then C:\Program Files\Vendor\Sub.exe, before reaching the intended binary. Wise Care 365 4.27 and Wise Disk Cleaner 9.29 register their services without surrounding quotes, exposing them to this resolution behavior. An Exploit-DB entry (#40417) documents reproducible exploitation of the issue.

Root Cause

The root cause is improper handling of search paths during service registration [CWE-428]. The installer writes the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\ without quoting the executable path, even though the install directory contains spaces. Windows treats each space-delimited segment as a candidate executable.

Attack Vector

Exploitation requires local access with permission to write to the system root or an intermediate path segment. An attacker drops a malicious payload named to match one of the intermediate tokens, for example C:\Program.exe. When the affected service starts, or when the system reboots, the Service Control Manager launches the planted binary under the LocalSystem account. This grants the attacker code execution with the highest privilege level on the host.

No verified proof-of-concept code is reproduced here. Refer to the VulnCheck Advisory for Wise Care and Exploit-DB #40417 for technical reproduction details.

Detection Methods for CVE-2016-20093

Indicators of Compromise

Presence of unexpected executables at C:\Program.exe or other root-level paths matching service path tokens
New or modified files in directories that overlap intermediate segments of the WiseBootAssistant or SpyHunter 4 Service paths
Service start events where the executed binary differs from the registered vendor path

Detection Strategies

Enumerate Windows services and flag any ImagePath value that contains spaces and is not wrapped in double quotes.
Audit registry keys under HKLM\SYSTEM\CurrentControlSet\Services\ for the affected service names and verify path quoting.
Correlate process creation events (Event ID 4688) where parent is services.exe and the child image resides outside the vendor install directory.

Monitoring Recommendations

Monitor write operations to the system root C:\ by non-administrative accounts and alert on new executable files.
Watch for service start failures followed by execution of unexpected binaries, which indicate path hijack attempts.
Track installation of legacy WiseCleaner versions across the fleet using software inventory tooling.

How to Mitigate CVE-2016-20093

Immediate Actions Required

Upgrade Wise Care 365 and Wise Disk Cleaner to current vendor releases that register services with quoted paths.
Remove or uninstall the vulnerable 4.27 and 9.29 builds from all managed Windows endpoints.
Restrict write permissions on C:\ and other root drive locations to administrators only.

Patch Information

Review vendor guidance at the WiseCleaner Homepage and the Wise Disk Cleaner Overview for current supported versions. The VulnCheck Advisory for Wise Care details the affected builds and remediation expectations.

Workarounds

Manually quote the ImagePath value for the WiseBootAssistant and SpyHunter 4 Service entries in the registry until the software is updated or removed.
Apply NTFS access control lists that deny write access to the system root for non-privileged users.
Disable the affected services if the functionality is not required in the environment.

bash

# Example: inspect and quote a service ImagePath on Windows (run as Administrator)
sc qc WiseBootAssistant
reg query "HKLM\SYSTEM\CurrentControlSet\Services\WiseBootAssistant" /v ImagePath
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WiseBootAssistant" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Wise\Wise Care 365\BootTime.exe\"" /f