PT-2026-25736 · Undefined · Undefined

CVE-2017-20218 · Publicado 2026-03-15 · Atualizado 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Serviio PRO version 1.8

Description The software contains an unquoted search path vulnerability in the Windows service, allowing local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path. Improper directory permissions grant the Users group full access, enabling authenticated users to replace the executable file with arbitrary binaries, potentially leading to privilege escalation during service startup or system reboot.

Recommendations Update Serviio PRO to a version that addresses this issue. Restrict directory permissions to prevent unauthorized modification of executable files. Ensure the Windows service path is properly quoted to prevent execution of arbitrary code.

Correção

LPE

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

CVE-2017-20218

Produtos afetados

Undefined

Referências · 9

• https://zeroscience.mk/en/vulnerabilities/ZSL-2017-5405.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-20218 · Nota de Segurança
• https://cxsecurity.com/issue/WLB-2017050019 · Nota
• https://packetstormsecurity.com/files/142384 · Nota
• https://blogs.securiteam.com/index.php/archives/3094 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/125644 · Nota
• https://exploit-db.com/exploits/41959 · Nota
• https://t.me/CVEtracker/47456 · Publicação no Telegram
• https://vulncheck.com/advisories/serviio-pro-local-privilege-escalation-via-unquoted-path · Nota