CVE-2020-36933: IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path
Published Jan 25, 2026
·Updated
HTC IPTInstaller 4.0.9 contains an unquoted service path vulnerability in the PassThru Service configuration. Attackers can exploit the unquoted binary path to inject and execute malicious code with elevated LocalSystem privileges.
Affected Software
1 affected component
HTC IPTInstaller
Event History
Jan 25, 2026
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-36933?
CVE-2020-36933 is classified as a high-severity vulnerability due to the potential for attackers to execute malicious code with elevated privileges.
2
How do I fix CVE-2020-36933?
To fix CVE-2020-36933, ensure that the service path for the 'PassThru Service' is enclosed in quotes to prevent exploitation.
3
What systems are affected by CVE-2020-36933?
CVE-2020-36933 affects HTC IPTInstaller version 4.0.9.
4
What type of vulnerability is CVE-2020-36933?
CVE-2020-36933 is an unquoted service path vulnerability that allows privilege escalation.
5
Can CVE-2020-36933 be exploited remotely?
CVE-2020-36933 requires local access to exploit, as it targets the service path configuration.