Home

Description

Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSystem permissions.

PUBLISHED Reserved 2026-01-27 | Published 2026-01-28 | Updated 2026-01-28 | Assigner VulnCheck




HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Unquoted Search Path or Element

Product status

1.2.0.0
affected

Credits

Mohammed Alshehri finder

References

www.exploit-db.com/exploits/48966 (ExploitDB-48966) exploit

www.gearboxcomputers.com/ (Vendor Homepage) product

www.vulncheck.com/...ler-pacserviceexe-unquoted-service-path (VulnCheck Advisory: Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path) third-party-advisory

cve.org (CVE-2020-36987)

nvd.nist.gov (CVE-2020-36987)

Download JSON