CVE-2020-36958
HighSummary
Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Kite\KiteService.exe' to inject malicious executables and escalate privileges on the system.
Risk Assessment
This vulnerability poses a risk to organizations by allowing local attackers to gain elevated privileges and potentially take control of the system. This could lead to serious security breaches and data loss.
Recommendation
It is recommended to update the Kite software to the latest version to eliminate this vulnerability. Additionally, it is advisable to review and secure service paths to prevent similar issues in the future.
Other vulnerabilities in KiteService Windows service
Original NVD description (English source)
Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Kite\KiteService.exe' to inject malicious executables and escalate privileges on the system.