CVE-2016-20095: Matrix42 Privilege Escalation Vulnerability

CVE-2016-20095 Overview

CVE-2016-20095 is an unquoted service path vulnerability in Matrix42 Remote Control Host 3.20.0031. The flaw affects the FastViewerRemoteService and FastViewerRemoteProxy Windows services. Local users can place a malicious executable along the unquoted path to gain code execution with SYSTEM privileges. The issue is categorized under CWE-428: Unquoted Search Path or Element. Exploitation requires local access and write permission to a directory along the service binary path, such as C:\Program Files\.

Critical Impact
A low-privileged local user can escalate to SYSTEM by dropping a crafted executable in a directory along the unquoted service path, achieving full host compromise on startup.

Affected Products

Matrix42 Remote Control Host 3.20.0031
FastViewerRemoteService Windows service
FastViewerRemoteProxy Windows service

Discovery Timeline

2026-06-19 - CVE-2016-20095 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2016-20095

Vulnerability Analysis

The vulnerability stems from Windows service binary paths registered without surrounding quotation marks. When Windows encounters a path containing spaces, it parses each space-delimited segment as a potential executable. For a service registered as C:\Program Files\Matrix42\...\service.exe, Windows will attempt to execute C:\Program.exe before falling through to subsequent candidates. An attacker who can write to C:\ or another directory along the path can stage a malicious binary that the Service Control Manager launches at service start. Because the FastViewerRemoteService and FastViewerRemoteProxy services run as LocalSystem, the planted binary inherits SYSTEM privileges. This converts a local user account into full host compromise on the next service restart or system reboot.

Root Cause

The Matrix42 installer registers service ImagePath values containing spaces without enclosing the path in quotes. The Windows Service Control Manager treats unquoted paths as a series of candidate executables, evaluating each space-separated prefix in order. This parser behavior is documented and well known, making correct path quoting a baseline secure-coding requirement under [CWE-428].

Attack Vector

An authenticated local user enumerates services using wmic service get name,pathname,startmode or sc qc <servicename> to identify unquoted paths. After locating the vulnerable Matrix42 service, the attacker writes a malicious binary, for example Program.exe, into a directory along the path that their account can write to. On service restart or system boot, the Service Control Manager launches the planted binary under the LocalSystem account. The attacker can then create privileged accounts, install persistence, disable security controls, or pivot deeper into the environment. A public proof-of-concept is available on Exploit-DB entry 39908 and the VulnCheck advisory.

Detection Methods for CVE-2016-20095

Indicators of Compromise

Unexpected executables such as Program.exe or Matrix42.exe located in C:\ or other directory roots along the service path.
New LocalSystem processes spawned as children of services.exe that do not match the legitimate Matrix42 binary hash or signature.
Modifications to the HKLM\SYSTEM\CurrentControlSet\Services\FastViewerRemoteService or FastViewerRemoteProxy registry keys.
Creation of new local administrator accounts shortly after a service or system restart.

Detection Strategies

Audit all installed services on Matrix42 hosts with wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "\"" to enumerate unquoted auto-start paths.
Monitor file creation events (Sysmon Event ID 11) for executables written to C:\, C:\Program.exe, or other top-level directories along service paths.
Alert on process creation (Sysmon Event ID 1) where a services.exe child runs from a directory outside the expected Matrix42 install location.

Monitoring Recommendations

Forward Windows Security, System, and Sysmon logs to a centralized SIEM and correlate service start events (Event ID 7036) with preceding file writes along service paths.
Track changes to service ImagePath registry values and flag any service running as LocalSystem whose path contains unquoted spaces.
Baseline legitimate Matrix42 binary hashes and alert on deviation when the service launches.

How to Mitigate CVE-2016-20095

Immediate Actions Required

Inventory all Windows hosts running Matrix42 Remote Control Host 3.20.0031 and confirm the ImagePath of FastViewerRemoteService and FastViewerRemoteProxy.
Restrict write permissions on C:\ and any parent directories along the service path so non-administrative users cannot drop binaries.
Quote the affected service paths by updating the registry ImagePath value to wrap the full executable path in double quotes, then restart the service.
Review local accounts and recently created scheduled tasks or services for signs of prior exploitation.

Patch Information

No vendor patch is referenced in the available CVE data. Administrators should contact Matrix42 for an updated build and consult the VulnCheck advisory for current remediation guidance. Until a fixed version is confirmed, apply the configuration workarounds below.

Workarounds

Manually correct the service ImagePath registry entries to enclose the full binary path in quotes for both FastViewerRemoteService and FastViewerRemoteProxy.
Harden ACLs on C:\ and C:\Program Files\ to deny write access for standard users and remove BUILTIN\Users write or modify entitlements.
Disable the Matrix42 services on hosts where remote control functionality is not required.

bash

# Repair the unquoted ImagePath for the affected services (run as Administrator)
sc config FastViewerRemoteService binPath= "\"C:\Program Files\Matrix42\FastViewer\FastViewerRemoteService.exe\""
sc config FastViewerRemoteProxy   binPath= "\"C:\Program Files\Matrix42\FastViewer\FastViewerRemoteProxy.exe\""

# Verify the corrected paths
sc qc FastViewerRemoteService
sc qc FastViewerRemoteProxy

# Restart the services to apply the change
net stop  FastViewerRemoteService && net start FastViewerRemoteService
net stop  FastViewerRemoteProxy   && net start FastViewerRemoteProxy