CVE-2020-37047: Deep Instinct Agent Privilege Escalation

CVE-2020-37047 Overview

Deep Instinct Windows Agent 1.2.29.0 contains an unquoted service path vulnerability in the DeepMgmtService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files\HP Sure Sense\DeepMgmtService.exe to inject malicious code that would execute with LocalSystem permissions during service startup.

Critical Impact

Local privilege escalation to LocalSystem allows complete system compromise through malicious executable injection in service paths.

Affected Products

• Deep Instinct Windows Agent 1.2.29.0
• HP Sure Sense (bundled with Deep Instinct agent)
• Windows systems running the vulnerable DeepMgmtService

Discovery Timeline

• 2026-02-01 - CVE CVE-2020-37047 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2020-37047

Vulnerability Analysis

This vulnerability falls under CWE-428 (Unquoted Search Path or Element), a configuration flaw that occurs when Windows service executables are registered without proper quotation marks around file paths containing spaces. When the DeepMgmtService is started, Windows attempts to resolve the unquoted path C:\Program Files\HP Sure Sense\DeepMgmtService.exe by sequentially checking for executables at each space-delimited segment of the path.

The exploitation mechanism relies on Windows' path resolution behavior. When encountering an unquoted path with spaces, Windows will attempt to execute files in the following order: C:\Program.exe, C:\Program Files\HP.exe, and C:\Program Files\HP Sure.exe before finally reaching the intended executable. An attacker with write access to any of these intermediate locations can plant a malicious executable that will be executed with the service's privileges—in this case, LocalSystem.

Root Cause

The root cause is improper service registration in the Windows registry where the ImagePath value for the DeepMgmtService lacks quotation marks around the executable path. The path C:\Program Files\HP Sure Sense\DeepMgmtService.exe contains multiple spaces, which without proper quoting allows Windows to misinterpret path boundaries during service startup.

Attack Vector

This is a local attack vector requiring the attacker to have local access to the target system. The attacker must have write permissions to one of the intermediate directories in the path resolution chain. Common attack scenarios include:

1. Creating a malicious C:\Program.exe if the root drive allows user writes
2. Placing HP.exe in the C:\Program Files\ directory if permissions allow
3. Creating Sure.exe in C:\Program Files\HP\ if that directory exists with weak permissions

When the service restarts (either through system reboot or manual restart), the malicious executable runs with LocalSystem privileges, providing complete system control to the attacker.

The vulnerability can be identified by querying Windows services for unquoted paths. Security researchers can use tools like PowerShell or the Windows Management Instrumentation Command-line (WMIC) to enumerate services with vulnerable configurations. Additional technical details are available in the Exploit-DB #48174 entry and the VulnCheck Advisory on Deep Instinct.

Detection Methods for CVE-2020-37047

Indicators of Compromise

• Unexpected executables named Program.exe, HP.exe, or Sure.exe in path resolution locations
• New or modified files in C:\, C:\Program Files\, or C:\Program Files\HP\ directories
• Unusual process execution chains originating from the DeepMgmtService startup
• Registry modifications to the DeepMgmtService ImagePath value

Detection Strategies

• Query all Windows services for unquoted paths using WMIC: wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
• Monitor file creation events in directories along the vulnerable path resolution chain
• Implement file integrity monitoring for critical system directories
• Use endpoint detection tools to alert on suspicious executable creation in path hijacking locations

Monitoring Recommendations

• Enable Windows Security Event logging for process creation (Event ID 4688) with command-line auditing
• Configure Sysmon to track file creation events in C:\, C:\Program Files\, and subdirectories
• Alert on service-related events (Event IDs 7045, 7040) indicating service configuration changes
• Monitor for privilege escalation patterns where low-privilege processes spawn high-privilege children

How to Mitigate CVE-2020-37047

Immediate Actions Required

• Audit all installed services for unquoted path vulnerabilities using the detection query above
• Manually correct the registry entry by adding quotes around the DeepMgmtService ImagePath value
• Restrict write permissions on directories in the vulnerable path chain (C:\, C:\Program Files\, C:\Program Files\HP\)
• Update to a patched version of Deep Instinct Windows Agent when available from the vendor

Patch Information

Organizations should check for updated versions of the Deep Instinct Windows Agent that address this unquoted service path issue. Contact Deep Instinct support or visit the Deep Instinct Homepage for the latest security updates and patched agent versions. Until a patch is applied, manual registry remediation is recommended.

Workarounds

• Manually quote the service path in the registry: Navigate to HKLM\SYSTEM\CurrentControlSet\Services\DeepMgmtService and modify the ImagePath value to include quotes
• Implement strict NTFS permissions on intermediate directories to prevent unauthorized file creation
• Use application whitelisting solutions to block execution of unauthorized executables in vulnerable path locations
• Deploy SentinelOne endpoint protection which can detect and prevent privilege escalation attempts through path hijacking

# Configuration example - Fix unquoted service path via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Services\DeepMgmtService" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\HP Sure Sense\DeepMgmtService.exe\"" /f