Input Director 1.4.3 - 'Input Director' Unquoted Service Path | Advisories

Advisories

Input Director 1.4.3 - 'Input Director' Unquoted Service Path

severity: high
date: January 28, 2026
Affecting: Input Director 1.4.3
CVE: CVE-2020-36990
CWE: CWE-428 Unquoted Search Path or Element
CVSS: 8.5
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-48795
Input Director Official Homepage
Credit: TOUHAMI Kasbaoui
Description: Input Director 1.4.3 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSystem permissions.