Security readout for executives and security teams
Plain-English summary
IObit Uninstaller 10 Pro may let a logged-in local attacker gain SYSTEM-level privileges on Windows. This is not a remote internet attack by itself, but it can turn a low-privilege foothold into full device control. Public exploit information exists, but the provided sources do not show active exploitation.
Executive priority
Prioritize remediation on managed Windows endpoints where IObit Uninstaller 10 Pro is installed. Treat this as a high-impact privilege escalation issue, not a standalone remote breach scenario. Address quickly if the software exists on shared or high-value systems.
Technical view
CVE-2020-36952 is a CWE-428 unquoted service path issue in the IObit Uninstaller Service for IObit Uninstaller 10 Pro. A local user with low privileges may place malicious code in a path that the service resolves during startup, causing execution as SYSTEM. CVSS v4.0 score is 8.5, AV:L/PR:L/UI:N.
Likely exposure
Exposure is limited to Windows systems running IObit Uninstaller 10 Pro with the vulnerable service configuration. Risk is highest on shared workstations, developer machines, kiosks, or endpoints where attackers could first obtain local user access.
Exploitation context
The issue requires local access and low privileges. It is useful for privilege escalation after initial compromise. ExploitDB is cited as public exploit material, but KEV is false and the provided sources do not support a claim of active exploitation in the wild.
Researcher notes
Public details identify an unquoted service path in the IObit Uninstaller Service. The source bundle does not name a fixed version, patch date, or vendor advisory beyond the product homepage. Avoid assuming all IObit versions are affected; the provided affected scope is version 10.
Mitigation direction
- Inventory endpoints for IObit Uninstaller 10 Pro installations.
- Check IObit and VulnCheck guidance for fixed versions or vendor remediation.
- Upgrade, remove, or restrict the software where business need is low.
- Limit local user privileges on systems where the product remains installed.
- Monitor service configuration changes and unexpected privileged process starts.
Validation and detection
- Confirm whether IObit Uninstaller version 10 is installed.
- Inspect the IObit Uninstaller Service path for unquoted paths containing spaces.
- Review endpoint telemetry for unusual service startup behavior.
- Verify remediation by confirming service path hardening or product update/removal.
- Document affected assets and owners for follow-up tracking.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-428: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36952 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-49371CVE reference · exploit
- IObit Official HomepageCVE reference · product
- VulnCheck Advisory: IObit Uninstaller 10 Pro - Unquoted Service PathCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.