First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2020-36977

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attackers to potentially inject malicious code. Attackers can exploit the unquoted path to replace the service binary with a malicious executable, enabling privilege escalation to LocalSystem account.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Wondershare	Wondershare Driver Install Service help	10.7.1.321

References

Timeline

Published: Jan 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2020

CVE-2020-369786.4Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Atta CVE-2020-369797.8Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service configuration. Attackers c CVE-2020-36989.8Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon A CVE-2020-369807.8SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to CVE-2020-369817.8Motorola Device Manager 2.4.5 contains an unquoted service path vulnerability in the PST Service that allows local users to potentially exec CVE-2020-369827.8Motorola Device Manager 2.5.4 contains an unquoted service path vulnerability in the MotoHelperService.exe service that allows local users t CVE-2020-369837.8Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code during s CVE-2020-369847.8EPSON 1.124 contains an unquoted service path vulnerability in the SENADB service that allows local attackers to execute code with elevated CVE-2020-369857.8IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to exec CVE-2020-369867.8Prey 1.9.6 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated privileges. Att CVE-2020-369877.8Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute c CVE-2020-369885.4PDW File Browser version 1.3 contains stored and reflected cross-site scripting vulnerabilities that allow authenticated attackers to inject

CVE-2020-36977: High severity, CVSS 7.8 | Vulnix