PT-2025-49273 · Flexense · Diskboss

Published 2025-12-05 · Updated 2025-12-05 · CVE-2020-36879

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flexsense DiskBoss version 11.7.28

Description Flexsense DiskBoss version 11.7.28 allows unauthenticated attackers to elevate their privileges by exploiting its services, potentially leading to remote code execution during system startup or reboot with escalated privileges. The issue stems from an unquoted service path, enabling attackers to specify a malicious service name using the 'sc qc' command and execute arbitrary system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2020-36879

Affected Products

Diskboss

References · 6

• 🔥 https://exploit-db.com/exploits/49022 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36879 · Security Note
• https://diskboss.com/downloads.html · Note
• https://twitter.com/CVEnew/status/1997000973395321110 · Twitter Post
• https://vulncheck.com/advisories/flexsense-diskboss-service-unquoted-service-path-vulnerability · Note
• https://diskboss.com · Note