CVE-2017-20218

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2017-20218", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-03-15T17:44:18.599Z", "datePublished": "2026-03-15T18:34:25.800Z", "dateUpdated": "2026-03-16T14:20:17.881Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-15T18:34:25.800Z"}, "datePublic": "2017-05-03T00:00:00.000Z", "title": "Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path", "descriptions": [{"lang": "en", "value": "Serviio PRO 1.8 contains an unquoted search path vulnerability in the Windows service that allows local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path. Additionally, improper directory permissions with full access for the Users group allow authenticated users to replace the executable file with arbitrary binaries, enabling privilege escalation during service startup or system reboot."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Unquoted Search Path or Element", "cweId": "CWE-428", "type": "CWE"}]}], "affected": [{"vendor": "Serviio", "product": "Serviio PRO", "versions": [{"version": "1.8.0.0 PRO", "status": "affected"}, {"version": "1.7.1", "status": "affected"}, {"version": "1.7.0", "status": "affected"}, {"version": "1.6.1", "status": "affected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.5, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5405.php", "name": "Zero Science Lab Disclosure", "tags": ["third-party-advisory"]}, {"url": "https://blogs.securiteam.com/index.php/archives/3094", "name": "SecuriTeam Blogs", "tags": ["third-party-advisory"]}, {"url": "https://www.exploit-db.com/exploits/41959/", "name": "Exploit-DB", "tags": ["exploit"]}, {"url": "https://packetstormsecurity.com/files/142384", "name": "Packet Storm Security", "tags": ["exploit"]}, {"url": "https://cxsecurity.com/issue/WLB-2017050019", "name": "CXSecurity", "tags": ["third-party-advisory"]}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/125644", "name": "IBM X-Force Exchange", "tags": ["vdb-entry"]}, {"name": "VulnCheck Advisory: Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/serviio-pro-local-privilege-escalation-via-unquoted-path"}], "credits": [{"lang": "en", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2017-20218", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T14:11:16.737290Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T14:20:17.881Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2017-20218", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T14:11:16.737290Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T14:17:15.398Z"}}], "cna": {"title": "Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path", "credits": [{"lang": "en", "type": "finder", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Serviio", "product": "Serviio PRO", "versions": [{"status": "affected", "version": "1.8.0.0 PRO"}, {"status": "affected", "version": "1.7.1"}, {"status": "affected", "version": "1.7.0"}, {"status": "affected", "version": "1.6.1"}]}], "datePublic": "2017-05-03T00:00:00.000Z", "references": [{"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5405.php", "name": "Zero Science Lab Disclosure", "tags": ["third-party-advisory"]}, {"url": "https://blogs.securiteam.com/index.php/archives/3094", "name": "SecuriTeam Blogs", "tags": ["third-party-advisory"]}, {"url": "https://www.exploit-db.com/exploits/41959/", "name": "Exploit-DB", "tags": ["exploit"]}, {"url": "https://packetstormsecurity.com/files/142384", "name": "Packet Storm Security", "tags": ["exploit"]}, {"url": "https://cxsecurity.com/issue/WLB-2017050019", "name": "CXSecurity", "tags": ["third-party-advisory"]}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/125644", "name": "IBM X-Force Exchange", "tags": ["vdb-entry"]}, {"url": "https://www.vulncheck.com/advisories/serviio-pro-local-privilege-escalation-via-unquoted-path", "name": "VulnCheck Advisory: Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Serviio PRO 1.8 contains an unquoted search path vulnerability in the Windows service that allows local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path. Additionally, improper directory permissions with full access for the Users group allow authenticated users to replace the executable file with arbitrary binaries, enabling privilege escalation during service startup or system reboot."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-428", "description": "Unquoted Search Path or Element"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-15T18:34:25.800Z"}}}, "cveMetadata": {"cveId": "CVE-2017-20218", "state": "PUBLISHED", "dateUpdated": "2026-03-16T14:20:17.881Z", "dateReserved": "2026-03-15T17:44:18.599Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-15T18:34:25.800Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Serviio PRO", "vendor": "Serviio", "versions": [{"status": "affected", "version": "1.8.0.0 PRO"}, {"status": "affected", "version": "1.7.1"}, {"status": "affected", "version": "1.7.0"}, {"status": "affected", "version": "1.6.1"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Serviio PRO 1.8 contains an unquoted search path vulnerability in the Windows service that allows local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path. Additionally, improper directory permissions with full access for the Users group allow authenticated users to replace the executable file with arbitrary binaries, enabling privilege escalation during service startup or system reboot."}, {"lang": "es", "value": "Serviio PRO 1.8 contiene una vulnerabilidad de ruta de b\u00fasqueda sin comillas en el servicio de Windows que permite a usuarios locales ejecutar c\u00f3digo arbitrario con privilegios elevados al colocar ejecutables maliciosos en la ruta ra\u00edz del sistema. Adem\u00e1s, permisos de directorio incorrectos con acceso total para el grupo Usuarios permiten a usuarios autenticados reemplazar el archivo ejecutable con binarios arbitrarios, lo que permite la escalada de privilegios durante el inicio del servicio o el reinicio del sistema."}], "id": "CVE-2017-20218", "lastModified": "2026-06-17T01:15:26.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2017-20218", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T14:11:16.737290Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:17:51.317", "references": [{"source": "disclosure@vulncheck.com", "url": "https://blogs.securiteam.com/index.php/archives/3094"}, {"source": "disclosure@vulncheck.com", "url": "https://cxsecurity.com/issue/WLB-2017050019"}, {"source": "disclosure@vulncheck.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/125644"}, {"source": "disclosure@vulncheck.com", "url": "https://packetstormsecurity.com/files/142384"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/41959/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/serviio-pro-local-privilege-escalation-via-unquoted-path"}, {"source": "disclosure@vulncheck.com", "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5405.php"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-428"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.8.0.0 PRO"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.6.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Serviio PRO", "source": "cna", "vendor": "Serviio"}, "product": "serviio_pro", "vendor": "serviio"}], "analysis": {"en": {"generated_at": "2026-03-21T14:36:23.905511+00:00", "value": {"mitigation_remediation": ["Upgrade Serviio PRO to a version that fixes the unquoted path and directory permission flaws.", "If an upgrade is not immediately possible, stop or disable the Serviio Windows service to prevent the vulnerability from being exercised.", "Modify the permissions on the system root and the directories used by Serviio so that the Users group cannot write or replace executable files.", "Enable logging for service startup events and monitor for unexpected executable execution in the System folder."], "summary": {"action": "Apply Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Serviio PRO version 1.8 running on Windows operating systems. Only this specific version is known to contain the unquoted path and directory permission issues. No other versions or non\u2011Windows platforms are mentioned.", "description_and_impact": "Serviio PRO 1.8 contains an unquoted search path vulnerability in its Windows service that allows a local user to run arbitrary code with elevated privileges by placing malicious executables in a system root path. In addition, the installer sets the directory permissions for the Users group to full access, enabling authenticated users to overwrite the executable file with another binary. This weakness can be exploited to hijack the service startup or a system reboot, granting the attacker full control over the affected machine. The problem is categorized as CWE\u2011428, which warns about the risks of unquoted paths leading to unintended program execution.", "risk_and_exploitability": "The CVSS score of 8.5 indicates a high severity for the flaw, with a major impact on confidentiality and integrity when exploited. The EPSS score of less than 1% suggests that the likelihood of this vulnerability being weaponized in the wild is low, and it is not listed in the CISA KEV catalog. Based on the description, the attack vector is local; an attacker must have a local user account or otherwise be able to write to the system root directory to replace the executable. Once the malicious binary is in place, the service will load it with system privileges during startup or reboots, achieving privilege escalation."}}}}, "created": "2026-03-16T09:21:03.311966+00:00", "updated": "2026-03-23T14:01:21.021890+00:00", "vendors": ["serviio", "serviio$PRODUCT$serviio_pro"]}