CVE-2020-36929: Brother BRPrint Auditor Privilege Escalation

CVE-2020-36929 Overview

Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability (CWE-428) in its Windows service configurations that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted file paths in BrAuSvc and BRPA_Agent services to inject malicious executables and escalate privileges on the system.

Critical Impact

Local privilege escalation vulnerability allows attackers with local access to execute arbitrary code with elevated SYSTEM privileges by exploiting unquoted service paths in Brother BRPrint Auditor services.

Affected Products

• Brother BRPrint Auditor 3.0.7
• BrAuSvc Windows Service
• BRPA_Agent Windows Service

Discovery Timeline

• 2026-01-16 - CVE CVE-2020-36929 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2020-36929

Vulnerability Analysis

This vulnerability falls under the category of Insecure Permissions and Configuration Flaws, specifically an unquoted service path issue. When Windows services are configured with executable paths that contain spaces but lack proper quotation marks, the operating system's path resolution logic can be exploited. Windows attempts to locate executables by progressively parsing the path at each space character, treating each segment as a potential executable location.

In the case of Brother BRPrint Auditor 3.0.7, both the BrAuSvc and BRPA_Agent services contain unquoted paths that are vulnerable to this exploitation technique. An attacker with local access and write permissions to an intermediate directory in the service path can place a malicious executable that Windows will execute instead of the intended service binary.

Root Cause

The root cause of this vulnerability is improper service configuration during installation. The Brother BRPrint Auditor installer fails to properly quote the service executable paths in the Windows registry. When a path like C:\Program Files\Brother\BRPrint Auditor\service.exe is left unquoted, Windows interprets spaces as potential path terminators, allowing an attacker to place a malicious executable at locations such as C:\Program.exe or C:\Program Files\Brother\BRPrint.exe.

Attack Vector

The attack vector requires local access to the system. An attacker must have write permissions to a directory that falls within the unquoted path resolution sequence. When the vulnerable service starts, stops, or restarts, Windows will execute the attacker's malicious executable with the privileges of the service account—typically SYSTEM level privileges for Windows services.

The exploitation flow involves:

1. Identifying the unquoted service path in the Windows registry
2. Determining which intermediate directory locations are writable
3. Placing a malicious executable with an appropriate name (e.g., Program.exe, BRPrint.exe)
4. Waiting for or triggering a service restart to execute the payload with elevated privileges

For technical details and proof-of-concept information, see the Exploit-DB entry #50005 and the VulnCheck Advisory.

Detection Methods for CVE-2020-36929

Indicators of Compromise

• Unexpected executables named Program.exe, BRPrint.exe, or similar in root directories or intermediate path locations
• Suspicious process creation events with parent processes being services.exe executing from non-standard paths
• New files appearing in C:\ or C:\Program Files\Brother\ directories that are not part of legitimate software installations
• Service failure events followed by successful execution from unusual paths

Detection Strategies

• Audit Windows services for unquoted paths using PowerShell: Get-WmiObject win32_service | Where-Object {$_.PathName -notlike '"*"' -and $_.PathName -like '* *'}
• Monitor file system changes to common unquoted path exploitation targets such as C:\Program.exe and intermediate directories
• Implement application whitelisting to prevent unauthorized executables from running with elevated privileges
• Review Windows Event Logs for Service Control Manager events (Event ID 7035, 7036) indicating service state changes

Monitoring Recommendations

• Enable file integrity monitoring on directories commonly targeted by unquoted service path attacks
• Configure endpoint detection and response (EDR) solutions to alert on executable creation in root directories and common exploitation paths
• Implement process monitoring to detect executables launched by services.exe from unexpected locations
• Regularly scan installed services for unquoted path vulnerabilities as part of security hygiene assessments

How to Mitigate CVE-2020-36929

Immediate Actions Required

• Audit all Brother BRPrint Auditor installations for the vulnerable version 3.0.7
• Manually correct the unquoted service paths in the Windows registry by adding quotation marks around the executable paths
• Restrict write permissions on directories that fall within the service path resolution sequence
• Consider uninstalling Brother BRPrint Auditor 3.0.7 if not actively required until a patched version is available

Patch Information

Check the Brother Auditor Pro3 Download page for updated software versions that address this vulnerability. Review the VulnCheck Advisory for the latest remediation guidance from security researchers.

Workarounds

• Manually quote the service paths in the Windows registry by navigating to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrAuSvc and BRPA_Agent, then editing the ImagePath value to include quotation marks
• Implement strict file system permissions to prevent non-administrative users from writing to exploitation target directories
• Use application control solutions like Windows Defender Application Control (WDAC) or AppLocker to restrict executable execution to approved paths only

# Configuration example - Registry fix for unquoted service paths
# Run in elevated Command Prompt to correct the BrAuSvc service path
reg add "HKLM\SYSTEM\CurrentControlSet\Services\BrAuSvc" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Brother\BRPrint Auditor\BrAuSvc.exe\"" /f

# Correct the BRPA_Agent service path
reg add "HKLM\SYSTEM\CurrentControlSet\Services\BRPA_Agent" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Brother\BRPrint Auditor\BRPA_Agent.exe\"" /f