CVE-2020-37098: Disk Sorter Privilege Escalation Flaw

CVE-2020-37098 Overview

Disk Sorter Enterprise 12.4.16 contains an unquoted service path vulnerability (CWE-428) that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.

Critical Impact

Local attackers with limited privileges can achieve arbitrary code execution with LocalSystem permissions by exploiting the unquoted service path, leading to complete system compromise.

Affected Products

• Disk Sorter Enterprise 12.4.16
• Disk Sorter Enterprise (versions prior to patched release)

Discovery Timeline

• February 3, 2026 - CVE CVE-2020-37098 published to NVD
• February 3, 2026 - Last updated in NVD database

Technical Details for CVE-2020-37098

Vulnerability Analysis

This vulnerability falls under CWE-428 (Unquoted Search Path or Element), a class of flaws that occurs when a Windows service executable path containing spaces is not properly enclosed in quotation marks. When Windows attempts to start a service with an unquoted path like C:\Program Files\Disk Sorter Enterprise\bin\disksorter.exe, the operating system interprets the space as a potential delimiter, leading to predictable path resolution behavior that can be exploited.

The impact of this vulnerability is significant as it allows a local attacker with standard user privileges to escalate to LocalSystem, the highest privilege level on Windows systems. This grants the attacker full control over the affected machine, including the ability to access sensitive data, install persistent backdoors, modify system configurations, and potentially pivot to other systems on the network.

Root Cause

The root cause of CVE-2020-37098 lies in the improper configuration of the Disk Sorter Enterprise Windows service registration. During installation, the service executable path was registered in the Windows Service Control Manager without proper quotation marks around the full path. When a path like C:\Program Files\Disk Sorter Enterprise\bin\disksorter.exe is stored unquoted, Windows follows a specific search order when resolving the path, attempting to execute C:\Program.exe, then C:\Program Files\Disk.exe, and so on, before reaching the intended executable.

Attack Vector

This is a local attack vector requiring the attacker to have local access to the vulnerable system. The exploitation process involves the attacker placing a malicious executable at one of the intermediate paths that Windows will attempt to execute before reaching the legitimate service binary.

For successful exploitation, an attacker would:

1. Identify the unquoted service path in the Disk Sorter Enterprise service configuration
2. Determine which intermediate paths are writable with their current privileges
3. Place a malicious executable (such as Disk.exe) in the C:\Program Files\ directory if write access is available
4. Wait for or trigger a service restart (system reboot, service failure recovery, or manual restart)
5. Upon service restart, Windows executes the attacker's malicious binary with LocalSystem privileges

The vulnerability can be verified by querying the service configuration using the Windows command line and examining whether the ImagePath value contains spaces but lacks quotation marks. For detailed technical analysis and proof-of-concept information, refer to the Exploit-DB #48048 entry.

Detection Methods for CVE-2020-37098

Indicators of Compromise

• Unexpected executable files named Program.exe, Disk.exe, or similar in root directories or C:\Program Files\
• Service failure events for Disk Sorter Enterprise followed by unusual process execution
• New processes spawning with LocalSystem privileges from unexpected executable paths
• File creation events in C:\ or C:\Program Files\ matching common truncated path names

Detection Strategies

• Query all Windows services for unquoted paths using wmic service get name,displayname,pathname,startmode | findstr /i /v "C:\Windows"
• Monitor for executable file creation in directories that intersect with common unquoted service paths
• Implement file integrity monitoring on directories commonly targeted by unquoted service path attacks
• Use SentinelOne's behavioral AI to detect anomalous process execution patterns indicative of service path exploitation

Monitoring Recommendations

• Enable Windows Security Event logging for service configuration changes (Event ID 7045)
• Monitor process creation events (Event ID 4688) for processes spawning from unexpected paths with SYSTEM privileges
• Configure alerts for new executable files appearing in root directories or C:\Program Files\
• Regularly audit service configurations for unquoted paths as part of security hygiene

How to Mitigate CVE-2020-37098

Immediate Actions Required

• Audit the Disk Sorter Enterprise service configuration and manually add quotation marks to the ImagePath registry value
• Check for and remove any suspicious executables in directories along the service path
• Upgrade Disk Sorter Enterprise to the latest version available from the official website
• Run a system-wide scan for unquoted service paths and remediate all findings

Patch Information

Users should check the DiskSorter Official Site for the latest version that addresses this vulnerability. Additionally, consult the VulnCheck Advisory for Disk Sorter for detailed remediation guidance. Organizations should prioritize upgrading to a patched version of Disk Sorter Enterprise that properly quotes the service executable path during installation.

Workarounds

• Manually correct the service path by adding quotation marks around the ImagePath value in the Windows Registry
• Restrict write permissions on intermediate directories that could be exploited (e.g., C:\Program Files\)
• Implement application whitelisting to prevent unauthorized executables from running
• If the software is not critical, consider uninstalling Disk Sorter Enterprise until a patched version is available

# Registry fix to quote the service path
reg add "HKLM\SYSTEM\CurrentControlSet\Services\DiskSorterService" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Disk Sorter Enterprise\bin\disksorter.exe\"" /f