Security readout for executives and security teams
Plain-English summary
CVE-2020-36986 affects Prey 1.9.6 on systems where its Windows CronService is installed with an unquoted service path. A local, low-privileged user may be able to gain elevated execution when the service starts or the system reboots. This is mainly an endpoint privilege-escalation risk, not a remote internet-facing issue.
Executive priority
Treat as high priority for endpoint hardening where Prey 1.9.6 is deployed. The business risk is local privilege escalation, which can worsen an existing compromise. It is less urgent than a remotely exploitable flaw, but public exploit availability supports timely remediation.
Technical view
The issue is CWE-428: an unquoted service path in Prey 1.9.6 CronService. The CVE record describes local code execution with elevated privileges by abusing path parsing during application startup or reboot. CVSS 4.0 is 8.5 high with local attack vector, low complexity, low privileges required, and high impact to confidentiality, integrity, and availability.
Likely exposure
Organizations are exposed if they run Prey 1.9.6, especially on shared Windows endpoints where local users have write access to relevant parent paths. Exposure is limited to local attackers or already-compromised user accounts; the sources do not indicate remote unauthenticated exploitation.
Exploitation context
Exploit-DB lists a public exploit reference, so defenders should assume the technique is known. The source bundle does not show CISA KEV listing or confirmed active exploitation. Successful abuse requires local access and service start conditions such as application startup or reboot.
Researcher notes
Evidence is limited to the CVE record, VulnCheck advisory, Exploit-DB reference, and vendor homepage. No source in the bundle names a specific fixed version or official remediation. Avoid claiming active exploitation. Validation should focus on version presence, service path quoting, and filesystem permissions.
Mitigation direction
- Identify endpoints running Prey 1.9.6 and prioritize them for review.
- Check vendor guidance or newer Prey releases for an official fix.
- Restrict local write permissions on service path parent directories.
- Remove or disable Prey where it is no longer required.
- Monitor endpoints for unusual service-start privilege escalation behavior.
Validation and detection
- Inventory installed Prey versions across managed endpoints.
- Review the CronService configuration for an unquoted executable path.
- Confirm local directory permissions do not allow low-privileged writes in service path locations.
- Check endpoint logs around service starts and reboots for suspicious elevated execution.
- Document compensating controls if immediate upgrade or removal is not possible.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-428: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36986 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-48967CVE reference · exploit
- Vendor HomepageCVE reference · product
- VulnCheck Advisory: Prey 1.9.6 - "CronService" Unquoted Service PathCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unquoted Search Path or Element
Unquoted Search Path or Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.