PT-2026-5851 · Lavasoft · Web Companion

Published 2026-02-03 · Updated 2026-02-03 · CVE-2020-37102

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Adaware Web Companion 4.9.2159 contains an unquoted service path vulnerability in the WCAssistantService that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2020-37102

Affected Products

Web Companion

References · 5

• 🔥 https://exploit-db.com/exploits/47852 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37102 · Security Note
• https://vulncheck.com/advisories/adaware-web-companion-wcassistantservice-unquoted-service-path · Note
• http://webcompanion.com/LP-WC002/index.php?partner=LU150701WEBDIRECT&campaign=www.doc2pdf.com&search=2&homepage=2&bd=2 · Note
• http://webcompanion.com · Note