CVE-2020-37037

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Avast SecureLine 5.5.522.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem account permissions during service startup.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published: Feb 1, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2020

CVE-2020-370387.5Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSy CVE-2020-370397.5Frigate 2.02 contains a denial of service vulnerability that allows attackers to crash the application by sending oversized input to the com CVE-2020-37047.5u'While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from central device may lead peripheral sy CVE-2020-370408.4Code Blocks 17.12 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious fil CVE-2020-370417.5OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary file CVE-2020-370428.4Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the 'Find Computer' feature that allows attackers to execute CVE-2020-370439.810-Strike Bandwidth Monitor 3.9 contains a buffer overflow vulnerability that allows attackers to bypass SafeSEH, ASLR, and DEP protections CVE-2020-370446.1OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary Jav CVE-2020-370457.8Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potent CVE-2020-370465.3Sistem Informasi Pengumuman Kelulusan Online 1.0 contains a cross-site request forgery vulnerability that allows attackers to add unauthoriz CVE-2020-370477.8Deep Instinct Windows Agent 1.2.29.0 contains an unquoted service path vulnerability in the DeepMgmtService that allows local users to poten CVE-2020-370487.8Iskysoft Application Framework Service 2.4.3.241 contains an unquoted service path vulnerability that allows local users to potentially exec