CVE-2020-37251: RealTimes Desktop Service 18.1.4 Unquoted Service Path Privilege Escalation
RealTimes Desktop Service 18.1.4 contains an unquoted service path vulnerability in the rpdsvc.exe binary that allows local attackers to escalate privileges. Attackers can place malicious executables in unquoted path directories to execute arbitrary code with LocalSystem privileges during service startup or system reboot.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the service ImagePath for the RealTimes Desktop Service so the full path to rpdsvc.exe is enclosed in double quotes. Update the service ImagePath (for example via the registry key HKLM\SYSTEM\CurrentControlSet\Services\<service> or via 'sc config') so the executable path is quoted to eliminate the unquoted service path vulnerability.
RealTimes Desktop Service 18.1.4 (rpdsvc.exe) Service ImagePath (service executable path) = Quoted full path to rpdsvc.exe (surrounded by double quotes) - Compensating control
Restrict NTFS permissions on any directories referenced by the (previously) unquoted service path for rpdsvc.exe to prevent write access by non-privileged users. Ensure only administrative accounts can create or modify files in those directories to prevent placement of malicious executables.
- Operational
After correcting the service ImagePath for rpdsvc.exe, restart the RealTimes Desktop Service or reboot the system so the change takes effect and the service starts using the quoted path.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37251?
CVE-2020-37251 has a severity rating of 8.5, indicating high risk.
How can I fix CVE-2020-37251?
To fix CVE-2020-37251, ensure that the service path for rpdsvc.exe is correctly quoted to prevent privilege escalation.
Who is affected by CVE-2020-37251?
CVE-2020-37251 affects users of RealTimes Desktop Service version 18.1.4.
What type of vulnerability is CVE-2020-37251?
CVE-2020-37251 is an unquoted service path vulnerability that allows local privilege escalation.
Can CVE-2020-37251 be exploited remotely?
CVE-2020-37251 cannot be exploited remotely as it requires local access to the system.