{"id":"CVE-2020-36987","state":"PUBLISHED","title":"Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path","description":"Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSystem permissions.","publishedAt":"2026-01-28T12:29:00.306Z","updatedAt":"2026-07-28T01:47:06.460Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Gearboxcomputers Program Access Controller"],"affected":[{"vendor":"Gearboxcomputers","product":"Program Access Controller","versions":[{"version":"1.2.0.0","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/48966","https://www.gearboxcomputers.com/","https://www.vulncheck.com/advisories/program-access-controller-pacserviceexe-unquoted-service-path"],"weaknesses":["CWE-428"],"ingestedAt":"2026-10-29T19:47:24.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/36xxx/CVE-2020-36987.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-36987","state":"PUBLISHED","datePublished":"2026-01-28T12:29:00.306Z","dateUpdated":"2026-07-28T01:47:06.460Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-27T15:47:07.999Z"},"containers":{"cna":{"title":"Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path","descriptions":[{"lang":"en","value":"Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSystem permissions."}],"affected":[{"vendor":"Gearboxcomputers","product":"Program Access Controller","versions":[{"version":"1.2.0.0","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/48966","name":"ExploitDB-48966","tags":["exploit"]},{"url":"https://www.gearboxcomputers.com/","name":"Vendor Homepage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/program-access-controller-pacserviceexe-unquoted-service-path","name":"VulnCheck Advisory: Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-428","lang":"en","description":"Unquoted Search Path or Element","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-07-28T01:47:06.460Z"},"datePublic":"2020-08-25T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:aviatrix:controller:1.2.0.0:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Mohammed Alshehri","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-28T14:53:24.537472Z","id":"CVE-2020-36987","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-28T14:53:35.873Z"}}]}}}