PT-2026-4653 · Kmspico · Kmspico

Samalucard · Published 2026-01-25 · Updated 2026-01-25 · CVE-2020-36935

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KMSpico version 17.1.0.0

Description KMSpico 17.1.0.0 has an unquoted service path issue in the Service KMSELDI configuration. This could allow local attackers to execute arbitrary code. The issue stems from an unquoted binary path located at 'C:Program FilesKMSpicoService KMS.exe', which enables attackers to inject malicious executables and potentially escalate privileges.

Recommendations Apply updates to address the unquoted service path issue in the Service KMSELDI configuration. As a temporary workaround, restrict access to the 'C:Program FilesKMSpicoService KMS.exe' file to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2020-36935

Affected Products

Kmspico

References · 6

• 🔥 https://exploit-db.com/exploits/49003 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36935 · Security Note
• https://vulncheck.com/advisories/kmspico-service-kmseldi-unquoted-service-path · Note
• https://t.me/CVEtracker/42952 · Telegram Post
• https://official-kmspico.com · Note
• https://t.me/cveNotify/149807 · Telegram Post