CVE-2020-37247

High

Published: 16/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to escalate privileges by exploiting the service binary path.

Risk Assessment

Attackers can place a malicious executable in the Program Files directory to be executed with LocalSystem privileges when the service starts, posing a serious security risk to the system.

Recommendation

It is recommended to secure service paths and monitor the Program Files directory for unauthorized executable files.

Other vulnerabilities in KiteService Windows service

CVE-2020-36958High
Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Kite\KiteService.exe' to inject malicious executables and escalate privileges on the system.

Original NVD description (English source)

Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the Program Files directory to be executed with LocalSystem privileges when the service starts.