CVE-2020-37250: TFTP Broadband Privilege Escalation Flaw

CVE-2020-37250 Overview

CVE-2020-37250 is an unquoted service path vulnerability in TFTP Broadband 4.3.0.1465 from Weird Solutions. The tftpt.exe service binary registers with an unquoted path containing spaces, allowing local attackers to plant a malicious executable along the path. When the service starts or the system reboots, Windows executes the planted binary with LocalSystem privileges. The flaw is classified under CWE-428: Unquoted Search Path or Element.

Critical Impact
A local user with write access to a directory along the unquoted service path can achieve arbitrary code execution as LocalSystem, resulting in full host compromise.

Affected Products

Weird Solutions TFTP Broadband version 4.3.0.1465
Windows installations running the tftpt.exe service
Systems where non-administrators have write access to C:\Program Files\ subdirectories along the service path

Discovery Timeline

2026-06-19 - CVE-2020-37250 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2020-37250

Vulnerability Analysis

The TFTP Broadband installer registers the tftpt.exe Windows service with an ImagePath that contains spaces but is not enclosed in quotation marks. Windows Service Control Manager (SCM) parses unquoted paths by splitting on whitespace and attempting to execute each candidate in sequence. An attacker who can write to any intermediate directory in the path can place a malicious binary that SCM will load before the legitimate executable.

Because the service runs under the LocalSystem account, successful exploitation grants complete control over the host. This includes credential theft, persistence installation, and lateral movement preparation.

Root Cause

The root cause is improper quoting of the service binary path during installation. When a path such as C:\Program Files\Weird Solutions\TFTP Broadband\tftpt.exe is registered without surrounding quotes, the SCM attempts to execute C:\Program.exe, then C:\Program Files\Weird.exe, and so on, before reaching the intended binary.

Attack Vector

Exploitation requires local access with write permissions to one of the directories along the unquoted path. The attacker drops a payload such as Program.exe or Weird.exe at the appropriate location. On the next service restart, system reboot, or scheduled task triggering the service, the planted binary executes with LocalSystem privileges. No user interaction is required after the binary is placed.

Technical details and a proof-of-concept are documented in the Exploit-DB entry #49852 and the VulnCheck advisory.

Detection Methods for CVE-2020-37250

Indicators of Compromise

Presence of unexpected executables such as Program.exe, Weird.exe, or TFTP.exe in the root of C:\ or within C:\Program Files\ and its subdirectories
Service start events where tftpt.exe resolves to an unexpected binary path
Child processes spawned by services.exe running as NT AUTHORITY\SYSTEM with anomalous image paths

Detection Strategies

Audit the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\ for any service whose path contains spaces and is not quoted
Run wmic service get name,pathname,startmode | findstr /i /v "\"" to enumerate unquoted service paths on Windows hosts
Monitor file creation events in C:\ and C:\Program Files\ for executables created by non-administrative users

Monitoring Recommendations

Alert on writes to directories along service binary paths by non-SYSTEM, non-Administrator principals
Track Windows Event ID 7045 (service installed) and 4697 (service installed via Security log) for new or modified service registrations
Correlate process creation events (Sysmon Event ID 1) where the parent is services.exe and the child image resides outside expected installation directories

How to Mitigate CVE-2020-37250

Immediate Actions Required

Enumerate all services with unquoted paths and remediate by quoting the ImagePath value
Restrict write permissions on C:\, C:\Program Files\, and C:\Program Files (x86)\ to administrators only
Stop or disable the tftpt.exe service on systems where TFTP Broadband is not required

Patch Information

No vendor patch is referenced in the available advisories. Consult the Weird Solutions website for the latest release of TFTP Broadband and apply any updated installer that registers the service with a properly quoted path. If no fix is available, remove the product or apply the registry workaround below.

Workarounds

Manually edit the service registration to quote the path: open HKLM\SYSTEM\CurrentControlSet\Services\tftpt\ImagePath and wrap the executable path in double quotes
Apply NTFS access control lists that deny write access to non-administrative users on every directory in the service path
Remove TFTP Broadband 4.3.0.1465 if a TFTP service is not operationally required

bash

# Verify and correct the unquoted service path using PowerShell (run as Administrator)
Get-WmiObject win32_service | Where-Object {
    $_.PathName -notlike '"*' -and $_.PathName -like '* *'
} | Select-Object Name, PathName, StartMode

# Example remediation for the affected service
sc.exe config tftpt binPath= "\"C:\Program Files\Weird Solutions\TFTP Broadband\tftpt.exe\""