CVE-2020-37231: Privacy Drive Privilege Escalation Flaw

CVE-2020-37231 Overview

CVE-2020-37231 is an unquoted service path vulnerability in Cybertron Soft Privacy Drive 3.17.0. The flaw resides in the pdsvc.exe service binary, which is registered with an unquoted file path containing spaces. Local attackers with low-privileged access can place a malicious executable in a parent directory of the service path. When the service starts or the system reboots, Windows resolves the unquoted path incorrectly and executes the attacker-controlled binary with LocalSystem privileges. The weakness is classified under [CWE-428] Unquoted Search Path or Element.

Critical Impact

Successful exploitation grants LocalSystem privileges, providing full control over the affected Windows host and enabling persistence, credential theft, and lateral movement.

Affected Products

• Cybertron Soft Privacy Drive 3.17.0
• Windows installations running the pdsvc.exe service
• Systems where the Privacy Drive service binary path contains spaces and is not enclosed in quotes

Discovery Timeline

• 2026-05-16 - CVE-2020-37231 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2020-37231

Vulnerability Analysis

The vulnerability stems from how Windows resolves service binary paths that contain spaces without surrounding quotation marks. When the Service Control Manager (SCM) starts pdsvc.exe, it parses the ImagePath registry value from left to right. If the path is unquoted and contains spaces, Windows attempts to execute each space-delimited prefix as an executable before reaching the intended binary.

For example, if the service is registered as C:\Program Files\Privacy Drive\pdsvc.exe, Windows will sequentially attempt to launch C:\Program.exe, then C:\Program Files\Privacy.exe, before resolving the correct target. An attacker who can write to any of these intermediate locations can hijack service startup.

The vulnerability requires only local low-privileged access. No user interaction is needed, and exploitation succeeds at service start or system reboot.

Root Cause

The root cause is improper quoting of the ImagePath value in the Windows service registration for pdsvc.exe. The installer fails to wrap the binary path in double quotes, leaving SCM to apply legacy path-resolution behavior that prioritizes shorter prefixes over the intended executable.

Attack Vector

Exploitation requires local code execution as a standard user. The attacker identifies the unquoted service path using built-in tooling such as wmic service get name,pathname,startmode. They then place a malicious executable at a writable directory matching one of the parsed prefixes, such as C:\Program.exe. On the next service restart or system reboot, the SCM launches the malicious binary as NT AUTHORITY\SYSTEM. Refer to the Exploit-DB #49023 entry and the VulnCheck Advisory for additional technical context.

Detection Methods for CVE-2020-37231

Indicators of Compromise

• Presence of unexpected executables in root directories such as C:\Program.exe or C:\Program Files\Privacy.exe
• New child processes spawned by services.exe running from non-standard paths
• Modifications to the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\pdsvc
• Unexpected LocalSystem processes originating from user-writable directories

Detection Strategies

• Enumerate all services with wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\\windows\\\\" | findstr /i /v \"\\\"\" to identify unquoted paths
• Audit installed software for service binaries registered with paths containing spaces and no surrounding quotes
• Monitor file creation events in directories that match unquoted path prefixes, particularly in the root of system drives

Monitoring Recommendations

• Enable Windows Security event logging for service installation and modification events (Event IDs 7045, 4697)
• Alert on process creation events (Event ID 4688) where the parent is services.exe and the image path is unusual
• Track registry modifications to HKLM\SYSTEM\CurrentControlSet\Services\*\ImagePath for affected systems

How to Mitigate CVE-2020-37231

Immediate Actions Required

• Inventory all endpoints running Privacy Drive 3.17.0 and confirm whether the pdsvc.exe service path is unquoted
• Manually correct the ImagePath registry value to wrap the binary path in double quotes
• Restrict write permissions on the root of system drives and on C:\Program Files to prevent placement of hijack binaries by non-administrative users

Patch Information

No vendor-supplied patch is referenced in the available advisories. Consult the Cybertron Soft homepage for updated builds and verify the service registration after any reinstall using the Privacy Drive setup.

Workarounds

• Modify the service ImagePath value to enclose the full executable path in double quotes using sc config pdsvc binPath= "\"C:\Program Files\Privacy Drive\pdsvc.exe\""
• Remove write permissions for non-administrative users on directories that could host hijack binaries along the unquoted path
• Disable the pdsvc service on systems where Privacy Drive functionality is not required until the configuration is corrected

# Configuration example - correct the unquoted service path
sc config pdsvc binPath= "\"C:\Program Files\Privacy Drive\pdsvc.exe\""
sc qc pdsvc