{"id":"CVE-2020-37058","state":"PUBLISHED","title":"Andrea ST Filters Service 1.0.64.7 - Unquoted service path","description":"Andrea ST Filters Service 1.0.64.7 contains an unquoted service path vulnerability in its Windows service configuration. Local attackers can exploit the unquoted path to inject malicious code that will execute with elevated LocalSystem privileges during service startup.","publishedAt":"2026-01-30T16:16:40.639Z","updatedAt":"2026-01-30T16:33:33.288Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Andrea Electronics Andrea ST Filters Service"],"affected":[{"vendor":"Andrea Electronics","product":"Andrea ST Filters Service","versions":[{"version":"1.0.64.7","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/48396","https://andreaelectronics.com/","https://www.vulncheck.com/advisories/andrea-st-filters-service-unquoted-service-path"],"weaknesses":["CWE-428"],"ingestedAt":"2026-10-29T19:47:27.394Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/37xxx/CVE-2020-37058.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-37058","state":"PUBLISHED","datePublished":"2026-01-30T16:16:40.639Z","dateUpdated":"2026-01-30T16:33:33.288Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-28T18:18:30.526Z"},"containers":{"cna":{"title":"Andrea ST Filters Service 1.0.64.7 - Unquoted service path","descriptions":[{"lang":"en","value":"Andrea ST Filters Service 1.0.64.7 contains an unquoted service path vulnerability in its Windows service configuration. Local attackers can exploit the unquoted path to inject malicious code that will execute with elevated LocalSystem privileges during service startup."}],"affected":[{"vendor":"Andrea Electronics","product":"Andrea ST Filters Service","versions":[{"version":"1.0.64.7","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/48396","name":"ExploitDB-48396","tags":["exploit"]},{"url":"https://andreaelectronics.com/","name":"Andrea Electronics Official Homepage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/andrea-st-filters-service-unquoted-service-path","name":"VulnCheck Advisory: Andrea ST Filters Service 1.0.64.7 - Unquoted service path","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-428","lang":"en","description":"Unquoted Search Path or Element","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-01-30T16:16:40.639Z"},"datePublic":"2020-04-28T00:00:00.000Z","credits":[{"lang":"en","value":"Roberto Piña","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-30T16:33:26.612705Z","id":"CVE-2020-37058","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-30T16:33:33.288Z"}}]}}}