CVE-2020-36974

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in 'C:\Program Files\IDT\WDM\AESTSr64.exe' to inject malicious code that would execute during service startup or system reboot.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published
Jan 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2020

CVE-2020-369757.8EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrCVE-2020-369767.8Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local userCVE-2020-369777.8Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attaCVE-2020-369786.4Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. AttaCVE-2020-369797.8Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service configuration. Attackers cCVE-2020-36989.8Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon ACVE-2020-369807.8SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers toCVE-2020-369817.8Motorola Device Manager 2.4.5 contains an unquoted service path vulnerability in the PST Service that allows local users to potentially execCVE-2020-369827.8Motorola Device Manager 2.5.4 contains an unquoted service path vulnerability in the MotoHelperService.exe service that allows local users tCVE-2020-369837.8Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code during sCVE-2020-369847.8EPSON 1.124 contains an unquoted service path vulnerability in the SENADB service that allows local attackers to execute code with elevated CVE-2020-369857.8IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to exec
CVE-2020-36974: High severity, CVSS 7.8 | Vulnix