CVE-2017-20218

The record

Serviio PRO 1.8 contains an unquoted search path vulnerability in the Windows service that allows local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path. Additionally, improper directory permissions with full access for the Users group allow authenticated users to replace the executable file with arbitrary binaries, enabling privilege escalation during service startup or system reboot.

Affected packages

Related vulnerabilities

• CVE-2026-66839 NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted… CWE-428
• CVE-2026-18755 A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with… CWE-428
• CVE-2026-9128 A code execution security issue exists within Studio 5000 Logix Designer® due to an… CWE-428
• CVE-2020-37253 Winstep 18.06.0096 contains an unquoted service path vulnerability in the Winstep Xtreme… CWE-428
• CVE-2020-37252 Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in… CWE-428
• CVE-2020-37254 Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an… CWE-428
• CVE-2021-47985 Brother SAPSprint 7.60 contains an unquoted service path vulnerability in the SAPSprint… CWE-428
• CVE-2022-50971 Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService… CWE-428