CVE-2020-36975: EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path
EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code by exploiting the service binary path. Attackers can leverage the unquoted path in 'C:\Program Files\Common Files\EPSON\EPW!3SSRP\ES60RPB.EXE' to inject malicious executables and escalate privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EPSON Status Monitor 3to a version that resolves this vulnerability.Fixed in 8.0Patch EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path - Compensating control
Ensure the Windows service/binary path for C:\Program Files\Common Files\EPSON\EPW!3SSRP\E_S60RPB.EXE is quoted (or otherwise secured) to prevent exploitation of an unquoted service path for malicious executable injection and privilege escalation.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36975?
CVE-2020-36975 has a medium severity rating due to its potential for local code execution.
How do I fix CVE-2020-36975?
To fix CVE-2020-36975, ensure that the service path for EPSON Status Monitor 3 is correctly quoted.
Who is affected by CVE-2020-36975?
CVE-2020-36975 affects users of EPSON Status Monitor 3 version 8.0.
What type of vulnerability is CVE-2020-36975?
CVE-2020-36975 is classified as an unquoted service path vulnerability.
Can CVE-2020-36975 be exploited remotely?
CVE-2020-36975 requires local access to the system to be exploited.