Security readout for executives and security teams
Plain-English summary
Popcorn Time 6.2.1.14 has a Windows service configuration flaw that can let a local, low-privileged user gain SYSTEM-level privileges. This is not a remote internet attack by itself, but it can significantly increase impact after an attacker already has access to an endpoint.
Executive priority
Treat as high priority where Popcorn Time is present, especially on shared endpoints. The main business risk is privilege escalation after initial access, not direct remote compromise. Removal may be the fastest risk reduction if the application is unauthorized.
Technical view
The Popcorn Time update service uses an unquoted service path, mapped to CWE-428. On Windows, this can allow unintended executable resolution during service startup, enabling local privilege escalation to SYSTEM. The CVSS 4.0 score is 8.5, with local attack vector, low complexity, low privileges required, and no user interaction.
Likely exposure
Exposure is limited to Windows systems with Getpopcorntime Popcorn Time version 6.2.1.14 installed and its update service present. Enterprise exposure is likely low unless this consumer application exists on managed endpoints.
Exploitation context
A public Exploit-DB entry is referenced, but the source bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation requires local access or an existing foothold, making this most relevant for post-compromise privilege escalation.
Researcher notes
The provided sources identify the affected version and vulnerability class, but do not provide a vendor patch statement. Exploit-DB indicates public exploit information exists; do not infer active exploitation from that alone. Validate service configuration and endpoint prevalence before broad prioritization.
Mitigation direction
- Inventory endpoints for Popcorn Time 6.2.1.14.
- Remove Popcorn Time where there is no business justification.
- Check vendor or trusted advisory guidance for fixed versions or configuration changes.
- Restrict local user write access to sensitive application and system directories.
- Prioritize remediation on shared or high-risk workstations.
Validation and detection
- Confirm whether Popcorn Time 6.2.1.14 is installed.
- Check whether the Popcorn Time update service exists.
- Review the service executable path for missing quotation marks.
- Verify local users cannot write to directories in the service path.
- Document remediation status in endpoint vulnerability tracking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-428: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-37059 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-48378CVE reference · exploit
- Popcorn Time Official HomepageCVE reference · product
- VulnCheck Advisory: Popcorn Time 6.2 - 'Update service' Unquoted Service PathCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unquoted Search Path or Element
Unquoted Search Path or Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.