Iskysoft Application Framework Service 2.4.3.241 unquoted search path

Summaryinfo

A vulnerability identified as problematic has been detected in Iskysoft Application Framework Service 2.4.3.241. Impacted is an unknown function. The manipulation leads to unquoted search path. This vulnerability is uniquely identified as CVE-2020-37048. Local access is required to approach this attack. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Iskysoft Application Framework Service 2.4.3.241. This issue affects some unknown functionality. The manipulation with an unknown input leads to a unquoted search path vulnerability. Using CWE to declare the problem leads to CWE-428. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Iskysoft Application Framework Service 2.4.3.241 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that would be run with the service's high-level system permissions.

The weakness was disclosed by Alejandro Reyes as 48171. It is possible to read the advisory at exploit-db.com. The identification of this vulnerability is CVE-2020-37048 since 01/28/2026. The exploitation is known to be difficult. Attacking locally is a requirement. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1574.009 according to MITRE ATT&CK.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (48171) and EUVD (EUVD-2020-30970). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Iskysoft

Name

• Application Framework Service

Version

• 2.4.3.241

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion