CVE-2016-20056

Spy Emergency build 23.0.205 contains an unquoted service path vulnerability in the SpyEmrgHealth and SpyEmrgSrv services that allows local attackers to escalate privileges by inserting malicious executables. Attackers can place executable files in the unquoted service path and trigger service restart or system reboot to execute code with LocalSystem privileges.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.spy-emergency.com/
http://www.spy-emergency.com/download/download.php?id=1
https://www.exploit-db.com/exploits/40550
https://www.vulncheck.com/advisories/spy-emergency-build-unquoted-service-path-privilege-escalation

Configurations

No configuration.

History

21 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Spy Emergency build 23.0.205 contiene una vulnerabilidad de ruta de servicio sin comillas en los servicios SpyEmrgHealth y SpyEmrgSrv que permite a atacantes locales escalar privilegios insertando ejecutables maliciosos. Los atacantes pueden colocar archivos ejecutables en la ruta de servicio sin comillas y activar el reinicio del servicio o el reinicio del sistema para ejecutar código con privilegios de LocalSystem.

04 Apr 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-04 14:16

Updated : 2026-07-21 07:10

NVD link : CVE-2016-20056

Mitre link : CVE-2016-20056

CVE.ORG link : CVE-2016-20056

JSON object : View

Products Affected

No product.

CWE

CWE-428

Unquoted Search Path or Element

{"id": "CVE-2016-20056", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2016-20056", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T17:53:56.666497Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Spy-Emergency", "product": "Spy Emergency", "versions": [{"status": "affected", "version": "23.0.205"}]}]}], "published": "2026-04-04T14:16:18.057", "references": [{"url": "http://www.spy-emergency.com/", "source": "disclosure@vulncheck.com"}, {"url": "http://www.spy-emergency.com/download/download.php?id=1", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/40550", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/spy-emergency-build-unquoted-service-path-privilege-escalation", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "Spy Emergency build 23.0.205 contains an unquoted service path vulnerability in the SpyEmrgHealth and SpyEmrgSrv services that allows local attackers to escalate privileges by inserting malicious executables. Attackers can place executable files in the unquoted service path and trigger service restart or system reboot to execute code with LocalSystem privileges."}, {"lang": "es", "value": "Spy Emergency build 23.0.205 contiene una vulnerabilidad de ruta de servicio sin comillas en los servicios SpyEmrgHealth y SpyEmrgSrv que permite a atacantes locales escalar privilegios insertando ejecutables maliciosos. Los atacantes pueden colocar archivos ejecutables en la ruta de servicio sin comillas y activar el reinicio del servicio o el reinicio del sistema para ejecutar c\u00f3digo con privilegios de LocalSystem."}], "lastModified": "2026-07-21T07:10:00.117", "sourceIdentifier": "disclosure@vulncheck.com"}