Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service Path

Advisories

severity: high
date: December 31, 2025
Affecting: 4.0.1.6(210120)
4.013(201105)
3.100(200225)
3.005(191206)
3.005(191112)
CVE: CVE-2020-36903
CWE: CWE-428 Unquoted Search Path or Element
CVSS: 8.5
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-49453
Vendor Homepage
Zero Science Lab Disclosure (ZSL-2021-5621)
Credit: LiquidWorm as Gjoko Krstic of Zero Science Lab
Description: Selea CarPlateServer 4.0.1.6 contains an unquoted service path vulnerability in the Windows service configuration that allows local users to potentially execute code with elevated privileges. Attackers can exploit the service's unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during application startup or reboot.