{"id":"CVE-2020-37102","state":"PUBLISHED","title":"Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path","description":"Adaware Web Companion 4.9.2159 contains an unquoted service path vulnerability in the WCAssistantService that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup.","publishedAt":"2026-02-03T14:49:23.873Z","updatedAt":"2026-03-05T01:27:58.567Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Lavasoft Web Companion"],"affected":[{"vendor":"Lavasoft","product":"Web Companion","versions":[{"version":"4.9.2159","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/47852","http://webcompanion.com/","http://webcompanion.com/LP-WC002/index.php?partner=LU150701WEBDIRECT&campaign=www.doc2pdf.com&search=2&homepage=2&bd=2","https://www.vulncheck.com/advisories/adaware-web-companion-wcassistantservice-unquoted-service-path"],"weaknesses":["CWE-428"],"ingestedAt":"2026-10-29T19:47:27.394Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/37xxx/CVE-2020-37102.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-37102","state":"PUBLISHED","datePublished":"2026-02-03T14:49:23.873Z","dateUpdated":"2026-03-05T01:27:58.567Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-02-01T13:16:06.489Z"},"containers":{"cna":{"title":"Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path","descriptions":[{"lang":"en","value":"Adaware Web Companion 4.9.2159 contains an unquoted service path vulnerability in the WCAssistantService that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup."}],"affected":[{"vendor":"Lavasoft","product":"Web Companion","versions":[{"version":"4.9.2159","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/47852","name":"ExploitDB-47852","tags":["exploit"]},{"url":"http://webcompanion.com/","name":"Vendor Homepage","tags":["product"]},{"url":"http://webcompanion.com/LP-WC002/index.php?partner=LU150701WEBDIRECT&campaign=www.doc2pdf.com&search=2&homepage=2&bd=2","name":"Software Download Link","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/adaware-web-companion-wcassistantservice-unquoted-service-path","name":"VulnCheck Advisory: Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-428","lang":"en","description":"Unquoted Search Path or Element","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T01:27:58.567Z"},"datePublic":"2020-01-05T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:codeworkweb:cww_companion:4.9.2159:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"ZwX","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-03T17:07:26.419744Z","id":"CVE-2020-37102","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-03T17:07:33.803Z"}}]}}}