CVE-2020-37061
📋 TL;DR
CVE-2020-37061 is an unquoted service path vulnerability in BOOTP Turbo 2.0.1214 that allows local attackers to execute arbitrary code with SYSTEM privileges. Attackers can place malicious executables in paths that get executed when the service starts. This affects systems running the vulnerable version of BOOTP Turbo.
💻 Affected Systems
- BOOTP Turbo
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing attackers to install persistent backdoors, steal credentials, or deploy ransomware.
Likely Case
Local privilege escalation leading to lateral movement within the network, credential harvesting, and persistence establishment.
If Mitigated
Limited impact if proper access controls prevent local users from writing to service directories and service runs with minimal privileges.
🎯 Exploit Status
Exploitation requires local access to create files in writable directories along the unquoted service path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.weird-solutions.com
Restart Required: Yes
Instructions:
1. Visit the vendor website for updates. 2. If no patch is available, apply workarounds. 3. Consider replacing with alternative software.
🔧 Temporary Workarounds
Quote Service Path
windowsModify the service path to include quotes around the executable path
sc config "BOOTP Turbo" binPath= "\"C:\Program Files\BOOTP Turbo\bootp.exe\""
Restrict Directory Permissions
windowsRemove write permissions from directories in the service path for non-administrative users
icacls "C:\Program Files" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Remove or disable the BOOTP Turbo service if not required
- Run the service with a lower-privileged account instead of LocalSystem
🔍 How to Verify
Check if Vulnerable:
Check if BOOTP Turbo 2.0.1214 is installed and the service path is unquoted using: sc qc "BOOTP Turbo"Check Version:
Check program version in Control Panel or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallVerify Fix Applied:
Verify the service path is quoted and directory permissions are restricted📡 Detection & Monitoring
Log Indicators:
- Service control manager events for BOOTP Turbo service modifications
- Process creation events from unexpected locations in service path directories
Network Indicators:
- Unusual outbound connections from systems running BOOTP Turbo
SIEM Query:
EventID=7045 AND ServiceName="BOOTP Turbo" OR ProcessCreation WHERE ImagePath contains "Program Files\BOOTP" AND NOT ImagePath starts with '"'