CVE-2016-20095
Matrix42 Remote Control Host 3.20.0031 Unquoted Path Privilege Escalation
- State
- Published
- Severity
- 8.5 High
- Published
- Jun 19, 2026
- Updated
- Jun 23, 2026
- Reserved
- Jun 19, 2026
Description
Matrix42 Remote Control Host 3.20.0031 contains an unquoted service path vulnerability in the FastViewerRemoteService and FastViewerRemoteProxy services that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can place a malicious executable in the Program Files directory with a crafted name to be executed by the service during startup, gaining elevated privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-428 Unquoted Search Path or Element
Affected Products
| Product | Versions |
|---|---|
Matrix42 Remote Control HostMatrix42 |
|
References
- ExploitDB-39908exploit
- Official Product Homepageproduct
- VulnCheck Advisory: Matrix42 Remote Control Host 3.20.0031 Unquoted Path Privilege Escalationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.