CVE-2020-36879

Flexsense DiskBoss Service Unquoted Service Path Vulnerability

State: Published
Severity: 8.5 High
Published: Dec 5, 2025
Updated: Dec 5, 2025
Reserved: Dec 5, 2025

Description

Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startup or reboot with escalated privileges. Attackers can exploit the unquoted service path vulnerability by specifying a malicious service name in the 'sc qc' command, allowing them to execute arbitrary system commands.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-428 Unquoted Search Path or Element

Affected Products

Product	Versions
DiskBossFlexsense	11.7.28Affected
DiskBoss ProFlexsense	11.7.28Affected
DiskBoss UltimateFlexsense	11.7.28Affected
DiskBoss ProFlexsense	11.7.28Affected
DiskBoss UltimateFlexsense	11.7.28Affected
DiskBoss ServerFlexsense	11.7.28Affected
DiskBoss EnterpriseFlexsense	11.7.28Affected

References

Exploit Database Entry 49022exploit
DiskBoss Homepageproduct
DiskBoss Software Linkproduct
https://www.vulncheck.com/advisories/flexsense-diskboss-service-unquoted-service-path-vulnerabilitythird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.