CVE-2020-37251: RealTimes Desktop Privilege Escalation

CVE-2020-37251 Overview

CVE-2020-37251 is an unquoted service path vulnerability in RealTimes Desktop Service version 18.1.4. The flaw resides in the rpdsvc.exe binary, which Windows registers with a path containing spaces but no surrounding quotation marks. A local authenticated attacker can place a malicious executable in a parent directory of the service path. Windows then executes the planted binary with LocalSystem privileges when the service starts or the host reboots. The vulnerability is classified under [CWE-428: Unquoted Search Path or Element].

Critical Impact
Successful exploitation grants LocalSystem privileges on Windows hosts running the affected RealTimes Desktop Service, enabling full system compromise from a low-privileged local account.

Affected Products

RealTimes Desktop Service 18.1.4
rpdsvc.exe service binary on Windows
Endpoints with the RealPlayer/RealTimes desktop client installed

Discovery Timeline

2026-06-19 - CVE-2020-37251 published to the National Vulnerability Database (NVD)
2026-06-23 - Record last modified in NVD

Technical Details for CVE-2020-37251

Vulnerability Analysis

The RealTimes Desktop Service registers rpdsvc.exe in the Windows Service Control Manager with an unquoted file path that contains one or more spaces. When Windows resolves an unquoted path, it interprets each space as a potential argument separator and attempts to execute every prefix before the space as an executable. An attacker with write access to any intermediate directory can drop a binary that Windows will launch instead of the intended service executable. Because Windows services typically run as LocalSystem, the attacker-supplied binary inherits the highest privilege level on the host. Refer to the VulnCheck Advisory on Privilege Escalation and Exploit-DB #49021 for the public technical write-up.

Root Cause

The installer for RealTimes Desktop Service registers the service ImagePath in the Windows registry without enclosing the full path in double quotes. Standard secure-coding guidance for Windows services requires quoting any ImagePath value that contains spaces. The omission allows Windows path resolution to be hijacked.

Attack Vector

Exploitation requires local access and write permissions to a directory along the unquoted path. The attacker stages a payload such as Program.exe in a writable parent directory, then triggers service restart or waits for a system reboot. Windows launches the planted executable under the LocalSystem security context, completing the privilege escalation from a standard user to SYSTEM.

No verified proof-of-concept code is reproduced here. The publicly documented exploitation pattern is described in Exploit-DB #49021.

Detection Methods for CVE-2020-37251

Indicators of Compromise

Unexpected executables such as Program.exe placed in the root of C:\ or in Program Files parent directories.
New child processes of services.exe running from non-standard paths with LocalSystem integrity.
Modifications to file system ACLs that grant write access to directories along the RealTimes service path.

Detection Strategies

Enumerate Windows services and flag any ImagePath value that contains spaces without surrounding quotation marks.
Monitor service binary launches that deviate from the expected rpdsvc.exe install path.
Alert on file creation events in writable directories that lie in the resolution path of any LocalSystem service.

Monitoring Recommendations

Enable Windows Security event ID 7045 (service installed) and 4697 monitoring across endpoints with RealTimes installed.
Track process creation events (Sysmon event ID 1) where the parent is services.exe and the image path is unexpected.
Audit local group membership and recent privilege use on hosts with the affected service.

How to Mitigate CVE-2020-37251

Immediate Actions Required

Inventory endpoints for RealTimes Desktop Service 18.1.4 and identify the registered ImagePath of rpdsvc.exe.
Restrict write permissions on every directory in the service path so non-administrative users cannot drop executables.
Disable or uninstall the RealTimes Desktop Service on systems where it is not required.

Patch Information

No vendor patch is referenced in the available advisory data. Consult the Real.com Main Site for any updated RealTimes builds and replace the affected version when a fixed release becomes available.

Workarounds

Manually correct the service ImagePath registry value so the full executable path is enclosed in double quotes.
Remove write and modify rights from Authenticated Users on directories along the unquoted service path.
Set the affected service start type to Disabled until remediation is verified.

bash

# Configuration example - quote the service ImagePath via reg.exe (run as Administrator)
sc.exe qc "RealTimes Desktop Service"
reg add "HKLM\SYSTEM\CurrentControlSet\Services\RealTimes Desktop Service" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Real\RealPlayer\rpdsvc.exe\"" /f
sc.exe qc "RealTimes Desktop Service"