CVE-2016-20058 in AMITI Antivirus
Summary
by MITRE • 04/04/2026
Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted service path and trigger service restart or system reboot to execute code with LocalSystem privileges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability identified as CVE-2016-20058 represents a critical privilege escalation flaw within Netgate AMITI Antivirus version 23.0.305. This issue stems from improper service path configuration where the AmitiAvSrv and AmitiAntivirusHealth services utilize unquoted paths in their service definitions. The fundamental technical flaw occurs when Windows attempts to resolve service paths that contain spaces but lack proper quotation marks, creating a predictable attack surface where malicious actors can inject code. According to the Common Weakness Enumeration framework, this vulnerability maps to CWE-428, which specifically addresses "Unquoted Service Path" weaknesses in Windows service configurations. The vulnerability exists because Windows follows a specific resolution order when executing services, and unquoted paths allow the system to interpret the path components as separate entities, potentially leading to execution of unintended binaries.
The operational impact of this vulnerability is severe as it provides local attackers with a straightforward path to escalate privileges from standard user level to LocalSystem privileges. When attackers place a malicious executable in the directory path leading to the vulnerable service, they can trigger code execution simply by restarting the affected service or rebooting the system. This attack vector is particularly dangerous because it requires no special privileges to exploit and can be executed silently in the background. The service restart mechanism becomes a critical trigger point where the system loads the malicious binary instead of the legitimate service executable. This vulnerability directly aligns with the MITRE ATT&CK framework under the privilege escalation tactic, specifically targeting the technique of service binary path modification to gain elevated system access.
The attack scenario begins with a local user identifying the vulnerable service paths through system enumeration or by examining service configurations using tools like sc query or PowerShell commands. Once the unquoted paths are identified, attackers create malicious executables with the same names as the legitimate service binaries but placed in the parent directories of the service paths. The timing of execution occurs during service restart operations or system reboots when Windows attempts to load the service binaries. This vulnerability is particularly concerning because antivirus software typically runs with high privileges, and the service paths are often located in directories accessible to local users. The exploitation process is relatively simple and can be automated, making it attractive to both malicious actors and automated exploit frameworks. Organizations should implement immediate mitigation strategies including proper quoting of service paths, regular service configuration audits, and privilege segregation to prevent unauthorized modification of service binaries.
The root cause analysis reveals that this vulnerability is a classic example of poor security configuration management in Windows services. The service configuration files lack proper path quoting, creating a fundamental flaw in the Windows service execution model. This issue demonstrates the importance of proper service hardening practices and adherence to security baselines. Organizations should conduct regular vulnerability assessments to identify similar unquoted service path issues across their entire service portfolio. The vulnerability also highlights the need for comprehensive service monitoring and the implementation of automated tools that can detect and alert on service path misconfigurations. Security teams should consider implementing service path integrity checks as part of their regular security maintenance procedures to prevent exploitation of similar vulnerabilities in other software components.