CVE-2020-36980: SAntivirus IC Privilege Escalation Flaw

CVE-2020-36980 Overview

SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability (CWE-428) in its Windows service configuration that allows local attackers to potentially execute arbitrary code. This vulnerability exists because the Windows service executable path is not properly enclosed in quotation marks, creating an opportunity for attackers to inject malicious executables into the service binary path. Successful exploitation can lead to privilege escalation, allowing attackers to gain system-level permissions on the affected system.

Critical Impact

Local attackers with low privileges can exploit this unquoted service path to achieve system-level code execution, potentially compromising the entire host system.

Affected Products

• SAntivirus IC 10.0.21.61

Discovery Timeline

• 2026-01-27 - CVE CVE-2020-36980 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2020-36980

Vulnerability Analysis

The vulnerability stems from improper handling of the service binary path in the Windows service configuration for SAntivirus IC. When a Windows service path contains spaces and is not enclosed in quotation marks, the Windows Service Control Manager (SCM) attempts to locate the executable by parsing the path at each space character. This behavior creates multiple potential execution points where an attacker can place a malicious executable.

For example, if the service path is C:\Program Files\SAntivirus IC\service.exe, Windows will attempt to execute files in the following order:

1. C:\Program.exe
2. C:\Program Files\SAntivirus.exe
3. C:\Program Files\SAntivirus IC\service.exe

An attacker with write access to any of these intermediate locations can plant a malicious executable that will be executed with the privileges of the service—typically SYSTEM level.

Root Cause

The root cause is the absence of quotation marks around the service executable path in the Windows registry configuration. This is a classic misconfiguration issue (CWE-428: Unquoted Search Path or Element) that occurs during software installation when the installer fails to properly quote paths containing spaces.

Attack Vector

This is a local attack vector requiring the attacker to have local access to the system with low privileges. The attacker must have write permissions to one of the directories in the unquoted path to successfully exploit this vulnerability. Once a malicious executable is placed in the appropriate location and the service is restarted (or the system reboots), the malicious code executes with elevated privileges.

The exploitation requires:

1. Local access to the target system
2. Write permissions to a directory in the unquoted service path
3. The ability to trigger a service restart or system reboot

Technical details and proof-of-concept information can be found in the Exploit-DB #49042 and the VulnCheck Security Advisory.

Detection Methods for CVE-2020-36980

Indicators of Compromise

• Unexpected executable files in C:\Program.exe or C:\Program Files\ root directories
• New executables named SAntivirus.exe in unexpected locations along the service path
• Unusual service restart events or service failure logs for SAntivirus IC
• Process execution events showing suspicious parent-child relationships with the SAntivirus service

Detection Strategies

• Monitor Windows registry keys under HKLM\SYSTEM\CurrentControlSet\Services\ for unquoted ImagePath values containing spaces
• Use PowerShell or WMIC queries to enumerate services with unquoted paths: wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """
• Implement file integrity monitoring on directories within common unquoted service paths
• Deploy endpoint detection rules to alert on executable creation in root directories like C:\Program.exe

Monitoring Recommendations

• Enable Windows Security Event logging for service installation and modification (Event IDs 4697, 7045)
• Monitor process creation events (Sysmon Event ID 1) for executables running from unusual paths with SYSTEM privileges
• Implement SentinelOne's behavioral AI to detect privilege escalation attempts through service manipulation
• Review and audit all installed services periodically for unquoted path vulnerabilities

How to Mitigate CVE-2020-36980

Immediate Actions Required

• Audit all Windows services for unquoted path vulnerabilities using built-in tools or security scanners
• Manually correct the SAntivirus IC service registry entry by adding quotation marks around the ImagePath value
• Restrict write permissions on directories that could be exploited (e.g., C:\ root, C:\Program Files\)
• Monitor the affected systems for any signs of exploitation attempts

Patch Information

No vendor patch information is currently available in the CVE data. Organizations should check the Segurazo Download Page for updated versions of the software. If no patched version is available, consider the workarounds below or evaluate alternative antivirus solutions.

Workarounds

• Manually fix the registry entry by enclosing the service path in quotation marks at HKLM\SYSTEM\CurrentControlSet\Services\SAntivirusIC\ImagePath
• Remove write permissions from directories in the unquoted path for non-administrative users
• Consider uninstalling SAntivirus IC if it is not essential and no patch is available
• Implement application whitelisting to prevent unauthorized executables from running

# Registry fix to quote the service path
$serviceName = "SAntivirusIC"
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$serviceName"

# Get current ImagePath
$currentPath = (Get-ItemProperty -Path $regPath).ImagePath

# Add quotes if not already present
if ($currentPath -notmatch '^".*"$') {
    $quotedPath = '"' + $currentPath + '"'
    Set-ItemProperty -Path $regPath -Name "ImagePath" -Value $quotedPath
    Write-Host "Service path updated to: $quotedPath"
}