PT-2026-25736 · Undefined · Undefined

Published 2026-03-15 · Updated 2026-03-16 · CVE-2017-20218

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Serviio PRO version 1.8

Description The software contains an unquoted search path vulnerability in the Windows service, allowing local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path. Improper directory permissions grant the Users group full access, enabling authenticated users to replace the executable file with arbitrary binaries, potentially leading to privilege escalation during service startup or system reboot.

Recommendations Update Serviio PRO to a version that addresses this issue. Restrict directory permissions to prevent unauthorized modification of executable files. Ensure the Windows service path is properly quoted to prevent execution of arbitrary code.

Fix

LPE

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2017-20218

Affected Products

Undefined

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2017-20218 · Security Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2017-5405.php · Note
• https://cxsecurity.com/issue/WLB-2017050019 · Note
• https://packetstormsecurity.com/files/142384 · Note
• https://blogs.securiteam.com/index.php/archives/3094 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/125644 · Note
• https://exploit-db.com/exploits/41959 · Note
• https://t.me/CVEtracker/47456 · Telegram Post
• https://vulncheck.com/advisories/serviio-pro-local-privilege-escalation-via-unquoted-path · Note