PT-2026-4653 · Kmspico · Kmspico

Samalucard · Publicado 2026-01-25 · Atualizado 2026-01-25 · CVE-2020-36935

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KMSpico version 17.1.0.0

Description KMSpico 17.1.0.0 has an unquoted service path issue in the Service KMSELDI configuration. This could allow local attackers to execute arbitrary code. The issue stems from an unquoted binary path located at 'C:Program FilesKMSpicoService KMS.exe', which enables attackers to inject malicious executables and potentially escalate privileges.

Recommendations Apply updates to address the unquoted service path issue in the Service KMSELDI configuration. As a temporary workaround, restrict access to the 'C:Program FilesKMSpicoService KMS.exe' file to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

CVE-2020-36935

Produtos afetados

Kmspico

Referências · 6

• 🔥 https://exploit-db.com/exploits/49003 · Exploit
• https://vulncheck.com/advisories/kmspico-service-kmseldi-unquoted-service-path · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-36935 · Nota de Segurança
• https://t.me/CVEtracker/42952 · Publicação no Telegram
• https://official-kmspico.com · Nota
• https://t.me/cveNotify/149807 · Publicação no Telegram