CVE-2020-37048: iskysoft iskysoft application framework service Unquoted Search Path or Element

Vulnerability summary

CVE-2020-37048 is a high (CVSS 8.5) Unquoted Search Path or Element vulnerability in iskysoft iskysoft application framework service. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-02-2026
   PublishedVulnerability first disclosed.
2. 02-02-2026
   Last modifiedVulnerability information updated.

Description

Iskysoft Application Framework Service 2.4.3.241 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that would be run with the service's high-level system permissions.

• CWE-428Unquoted Search Path or ElementThe product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.