CVE-2020-36986: Prey 1.9.6 Privilege Escalation Flaw

CVE-2020-36986 Overview

CVE-2020-36986 is an unquoted service path vulnerability in Prey 1.9.6, a device-tracking and anti-theft application. The flaw resides in the CronService Windows service, where the executable path is registered without surrounding quotation marks. Local users with write access to intermediate directories in the service path can place a malicious executable that Windows will launch instead of the intended binary. Successful exploitation results in code execution under the privileges of the service account, which is typically SYSTEM. This weakness is classified as [CWE-428: Unquoted Search Path or Element].

Critical Impact
Local attackers can escalate privileges to SYSTEM by planting a malicious executable along the unquoted CronService path, with execution triggered on service startup or system reboot.

Affected Products

Prey 1.9.6 for Windows
Prey CronService Windows service component
Earlier Prey versions sharing the same service installation logic

Discovery Timeline

2026-01-28 - CVE-2020-36986 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2020-36986

Vulnerability Analysis

The vulnerability arises from how the Prey installer registers the CronService Windows service. The service's ImagePath registry value contains spaces in the directory path but is not enclosed in quotation marks. When the Windows Service Control Manager parses an unquoted path that contains spaces, it attempts to execute each whitespace-delimited token as a potential executable, appending .exe and treating subsequent tokens as arguments.

An attacker who can write to a directory earlier in the path can place a malicious binary that Windows will execute on service start. Because the CronService runs with elevated privileges, the planted binary inherits those privileges. The flaw is local in nature and requires the attacker to already have low-privileged code execution on the host.

Root Cause

The root cause is improper construction of the service binary path during installation. The installer writes the path to HKLM\SYSTEM\CurrentControlSet\Services\CronService\ImagePath without wrapping it in quotes, violating Microsoft guidance on service path registration. This produces ambiguity that Windows resolves by walking the path left-to-right, creating opportunities for path hijacking.

Attack Vector

Exploitation requires local access and the ability to write to a directory that appears earlier in the unquoted service path than the legitimate Prey installation directory. The attacker places a crafted executable named to match the first whitespace-delimited token of the path. When the service starts, either through manual restart or system reboot, Windows launches the attacker's binary with the service account's privileges. See the Exploit-DB #48967 entry and the VulnCheck Advisory for technical details. No proof-of-concept code is reproduced here.

Detection Methods for CVE-2020-36986

Indicators of Compromise

Unexpected executables present in directories along the CronService install path, especially binaries whose names match the first space-delimited token of the path.
New service-launched processes parented to services.exe running from non-standard locations.
Modifications to the ImagePath value under HKLM\SYSTEM\CurrentControlSet\Services\CronService that lack surrounding quotation marks.

Detection Strategies

Audit Windows services on managed endpoints and flag any service whose ImagePath contains spaces but no enclosing quotes.
Monitor process creation events (Sysmon Event ID 1, Windows Event ID 4688) for services.exe spawning binaries from unexpected paths.
Alert on file write operations to directories that sit above legitimate installation folders for known services.

Monitoring Recommendations

Track registry modifications to service ImagePath values using Sysmon Event ID 13 and correlate with installer activity.
Inventory third-party services on Windows hosts and validate that all binary paths are properly quoted.
Review service start events (Windows Event ID 7045 for new services, 7036 for state changes) for anomalies after software installation.

How to Mitigate CVE-2020-36986

Immediate Actions Required

Identify hosts running Prey 1.9.6 or earlier and validate the CronServiceImagePath registry entry.
Restrict write permissions on parent directories along the service path so non-privileged users cannot place executables.
Manually correct the ImagePath value to enclose the full path in quotation marks where patching is not yet possible.

Patch Information

Review the Prey Project Home for current releases and update to a version where the CronService registration uses a quoted path. Confirm the fix by inspecting the service ImagePath after upgrade. Refer to the VulnCheck Advisory for vendor-coordinated remediation guidance.

Workarounds

Use sc.exe config CronService binPath= "\"C:\Path With Spaces\Prey\cronsvc.exe\"" to rewrite the service binary path with proper quoting.
Apply NTFS access control lists that deny write access to C:\, C:\Program Files, and intermediate directories for standard users.
Remove or disable the CronService if Prey is not actively required on the endpoint.

bash

# Configuration example: query and re-register the service path with quotes
sc.exe qc CronService
sc.exe config CronService binPath= "\"C:\Program Files (x86)\Prey\current\bin\node.exe\" \"C:\Program Files (x86)\Prey\current\lib\agent.js\""
sc.exe qc CronService