CVE-2020-36928: brother bragent Unquoted Search Path or Element

Vulnerability summary

CVE-2020-36928 is a high (CVSS 8.5) Unquoted Search Path or Element vulnerability in brother bragent. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-01-2026
   PublishedVulnerability first disclosed.
2. 16-01-2026
   Last modifiedVulnerability information updated.

Description

Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Brother\BRAgent\ to inject and execute malicious code with elevated system permissions.

• CWE-428Unquoted Search Path or ElementThe product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.