CVE-2020-37229 Overview
CVE-2020-37229 is an unquoted service path vulnerability in OKI sPSV Port Manager version 1.0.41. The flaw resides in the sPSVOpLclSrv service, which registers its binary path without proper quotation marks. Local attackers with low-privilege access can place a malicious executable along the service's search path. When the service starts or the system reboots, Windows executes the planted binary with LocalSystem privileges. The weakness is classified under [CWE-428: Unquoted Search Path or Element].
Critical Impact
Local attackers can escalate from a low-privilege account to LocalSystem, achieving full control over the affected Windows host.
Affected Products
- OKI sPSV Port Manager 1.0.41
- Windows installations running the sPSVOpLclSrv service
- Systems deployed via the sPSV_010041_2_270910.exe installer
Discovery Timeline
- 2026-05-16 - CVE-2020-37229 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2020-37229
Vulnerability Analysis
The sPSVOpLclSrv service registers its ImagePath registry value without surrounding the executable path in quotation marks. When Windows starts a service whose path contains spaces and lacks quotes, the Service Control Manager attempts to execute each space-delimited token as a potential binary. An attacker who can write to any intermediate directory along that path can stage a malicious executable that Windows will launch before reaching the legitimate binary. The planted binary inherits the service account context, which is LocalSystem for sPSVOpLclSrv. This grants the attacker SYSTEM-level code execution on the host.
Root Cause
The root cause is improper service registration during installation. The installer writes an ImagePath value containing spaces without enclosing the full path in double quotes. Combined with weak directory access control lists on parent folders along the path, this creates an exploitable privilege escalation primitive. The defect maps to [CWE-428].
Attack Vector
Exploitation requires local authenticated access with permission to write into a directory that appears along the unquoted service path. The attacker drops a crafted executable with a name matching the first space-delimited token, then waits for the service to restart or triggers a reboot. The service launches the attacker-controlled binary as LocalSystem, completing the escalation. No user interaction is required beyond the initial file placement.
A technical writeup and proof of concept are available in Exploit-DB #49005 and the VulnCheck Advisory on OKI sPSV Port Manager.
Detection Methods for CVE-2020-37229
Indicators of Compromise
- Unexpected executable files placed in directories along the sPSVOpLclSrv service path, particularly files matching the first space-delimited token of the registered ImagePath.
- New LocalSystem processes spawned as children of services.exe that do not match the legitimate OKI binary name or signing certificate.
- Service restarts or reboots followed immediately by unusual privileged process creation.
Detection Strategies
- Query the registry for service ImagePath values that contain spaces but lack enclosing double quotes, focusing on services running as LocalSystem.
- Audit Windows Event Log entries 7045 (service installed) and 7036 (service state change) for sPSVOpLclSrv activity.
- Monitor Sysmon Event ID 1 for process creation events where the parent is services.exe and the image path differs from the expected OKI binary.
Monitoring Recommendations
- Alert on file write operations into directories that sit along service search paths when performed by non-administrative accounts.
- Track integrity changes to the HKLM\SYSTEM\CurrentControlSet\Services\sPSVOpLclSrv registry key.
- Correlate service start events with subsequent privileged process creation to identify path hijacking attempts.
How to Mitigate CVE-2020-37229
Immediate Actions Required
- Inspect the ImagePath value for the sPSVOpLclSrv service and confirm whether the path is wrapped in double quotes.
- Restrict write permissions on every directory along the unquoted service path so that only administrators can create files there.
- Disable the sPSVOpLclSrv service on hosts where OKI printing functionality is not required.
Patch Information
No vendor patch is referenced in the available advisories for OKI sPSV Port Manager 1.0.41. Administrators should consult the OKI Official Website for updated driver releases and consider replacing the affected port manager with a current OKI driver build. Until a fixed version is confirmed, manual remediation of the registry ImagePath value is required.
Workarounds
- Manually quote the ImagePath registry value for sPSVOpLclSrv using sc.exe config sPSVOpLclSrv binPath= "\"C:\Path With Spaces\sPSVOpLclSrv.exe\"" from an elevated prompt.
- Apply restrictive NTFS access control lists to every parent directory referenced by the service path, removing write access for Authenticated Users and Users.
- Configure application allowlisting to block execution of unsigned binaries from non-standard directories under LocalSystem.
# Configuration example - re-register the service with a quoted ImagePath
sc.exe config sPSVOpLclSrv binPath= "\"C:\Program Files\OKI\sPSV\sPSVOpLclSrv.exe\""
icacls "C:\Program Files\OKI" /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
