CVE-2016-20093

Executive Summary

CVE-2016-20093 affects Wise Care 365 version 4.27 and Wise Disk Cleaner version 9.29, both products from developer Wisecleaner. The vulnerability stems from unquoted service path conditions present in two system services: the WiseBootAssistant component and what is identified in the NVD description as the "SpyHunter 4 Service." An unquoted service path flaw permits a local user to exploit the Windows service loader's behavior by inserting a malicious executable at a directory level within the service's path that the operating system parses with spaces. When the service starts—either manually during initialization or automatically during system reboot—the injected executable can run with SYSTEM-level privileges, resulting in complete local privilege escalation to the highest integrity level on the affected host. Attackers who achieve local access through any means—including low-privileged user accounts, malware infections, or compromised applications—can leverage this flaw to gain dominant control over the operating system. The vulnerability remains unpatched, has no available exploit code or public proof-of-concept, and carries a CVSS score of 8.5, reflecting significant severity for environments where these legacy Wisecleaner applications are still deployed.

Technical Analysis

The vulnerability class is an unquoted service path flaw, a well-documented Windows privilege escalation technique categorized under CWE-428 (Unquoted Search Path or Element). The mechanism is fundamentally a weakness in how the Windows Service Control Manager (SCM) parses executable paths within the registry key HKLM\SYSTEM\CurrentControlSet\Services, specifically the ImagePath value.

When a Windows service is installed with an ImagePath that contains spaces but is NOT enclosed in double quotes, the SCM hands the path to the Windows loader, which applies a deterministic search ordering. For example, if the service's executable is registered as C:\Program Files\Wise Care 365\WiseBootAssistant.exe without quotes, the loader checks, in this order:

1. C:\Program.exe
2. C:\Program Files\Wise.exe
3. C:\Program Files\Wise Care.exe
4. C:\Program Files\Wise Care 365\WiseBootAssistant.exe

The exact sequence of directory-level candidate executables depends on how many space-separated tokens exist in the full path. A local attacker with write permissions to any directory referred to during this search—most commonly C:\ itself, which by default grants authenticated users CREATE_FILES rights—can drop a crafted binary named to match one of the intermediate tokens (e.g., C:\Program.exe, C:\Program Files\Wise.exe).

The NVD description specifically identifies two affected services:

• WiseBootAssistant — associated with Wise Care 365 version 4.27
• SpyHunter 4 Service — associated with Wise Disk Cleaner version 9.29 (the presence of SpyHunter service in a Wisecleaner product is the vendor relationship providing the vulnerable service registration)

When either service is started—commonly configured to auto-start during boot—the SCM executes the first matching file in the search sequence. If the attacker's planted executable is found first, it runs in the security context of the service, which is SYSTEM. This provides immediate, elevated code execution without requiring any additional privilege escalation.

The attack surface is entirely local. The attacker must possess a local account (even a highly restricted user) or have already achieved code execution in a non-elevated context through a separate vector (e.g., a document exploit, phishing-delivered malware, or an application compromise). The flaw is not reachable over the network directly; it is a local privilege escalation (LPE) enabler. The CNA title explicitly confirms the impact: "Unquoted Service Path Privilege Escalation."

It is critical to note that the NVD description does not provide the full directory paths for either service; only the service names are disclosed. Consequently, the precise number of intermediate search steps and the exact directory requiring attacker-write permissions must be inferred from the service path, which is not publicly documented. Nevertheless, the overwhelming majority of unquoted service path vulnerabilities involve the C:\Program Files or C:\Program Files (x86) root, meaning the standard exploitation technique of planting a file at the root path is almost certainly applicable.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: An attacker with local, unprivileged access queries the list of running and registered services using standard Windows tools (e.g., sc query, wmic service get name,pathname — though the exact command is not restricted by the vulnerability description). The attacker identifies services whose ImagePath contains spaces and lacks surrounding quotes. The WiseBootAssistant (Wise Care 365 4.27) or SpyHunter 4 Service (Wise Disk Cleaner 9.29) present themselves as viable candidates. The attacker also verifies write permissions on candidate root directories (e.g., C:\) — a permission that the default Windows ACL grants to the Authenticated Users group.

Step 2 — Triggering the Specific Flaw: With the unquoted path confirmed, the attacker determines the directory enumeration order. Taking the probable path C:\Program Files\Wise Care 365\WiseBootAssistant.exe as the known class-level example (exact full path not specified in the NVD description), the search sequence produces candidate names at each directory boundary where a space appears. The first candidate, C:\Program.exe, is the attacker's primary target. The attacker creates a malicious executable file at the root of the system drive, naming it to match the first token of the unquoted path that is writable.

Step 3 — Payload Execution: The attacker's payload is a standalone executable, typically a Windows PE binary. It could be a simple reverse shell, a backdoor installer, or a system-level utility (e.g., to add the attacker's account to the local Administrators group, disable security software, or exfiltrate credential material). The attacker triggers service startup either by waiting for the scheduled auto-start event (e.g., next system reboot) or, if the service permits manual start by standard users (uncommon but possible), by sending a service control request. Some exploitation chains use the sc start <ServiceName> command — the exact command syntax is not a vulnerability detail but a Windows administration tool procedure. Upon service start, the SCM executes the planted binary at C:\Program.exe in the security context of the service, which runs as SYSTEM.

Step 4 — Post-Exploitation Persistence and Impact: With SYSTEM-level code execution, the attacker achieves total control over the host. This includes: reading and modifying any file, creating new users with administrative privileges, disabling or altering security software to prevent detection, installing kernel drivers or rootkits, harvesting credentials from LSASS memory or SAM database, and using the compromised host as a pivot point for lateral movement within the enterprise environment. Because the payload executes during service startup or reboot, the compromise persists across sessions — every reboot re-triggers the attack until the planted binary is removed or the service path is corrected.

Public exploit availability: No public PoC or exploit code is documented; the attack chain described above is inferred from the well-established unquoted service path vulnerability class and the explicit wording of the NVD description. The technique itself is a widely documented and commonly exploited Windows LPE technique.

Impact Assessment

Business Impact: This vulnerability enables local privilege escalation from a standard user context to SYSTEM. In enterprise environments, where end-user workstations run with least-privilege accounts, an attacker who compromises any single user session (via phishing, drive-by download, or supply chain) can escalate to full administrative control of the endpoint. This effectively bypasses the primary security boundary between user-level compromise and machine-level compromise, enabling anti-forensics, persistence, and lateral movement.

CVSS Reflection (Score: 8.5): The high score indicates a combination of high confidentiality, integrity, and availability impacts typical of total system compromise. The prerequisite of local access (likely reflected in an AV:L component) tempers the score from a network-reachable maximum; nevertheless, the impact on the affected system is severe.

Affected Systems: Systems running Wise Care 365 version 4.27 and Wise Disk Cleaner version 9.29. These are legacy utility applications, which increases likelihood of deployment on aging, less-managed endpoints and on systems where users run administrative maintenance tools. The specific inclusion of "SpyHunter 4 Service" suggests a third-party component integration, potentially broadening the attack surface to systems where Wise Disk Cleaner was installed alongside other security utilities.

Blast Radius: Individual host compromise. The vulnerability itself does not expose network services directly, so the blast radius at the network layer is nil. However, the FOLLOW-ON impact — compromised endpoints being used as beachheads for lateral movement — indirectly endangers the entire Active Directory environment.

EPSS Context: The EPSS score of 0.00175 (7.2% percentile) indicates that exploitation is not currently observed at meaningful scale in the wild. However, this low probability-of-exploitation percentile should not be misread as low risk; it reflects the absence of weaponized public exploits, not the absence of exploitability. The class of unquoted service path vulnerabilities is trivially exploitable by even low-skilled adversaries once the vulnerable service is identified.

Detection Guidance

Sigma Rule

title: Unquoted Service Path - Wisecleaner Products
id: 8f2b6e4a-5d23-4b7f-9e33-2cd5a9e18b4f
status: experimental
description: Detects creation of executables in root path that may be exploited by unquoted service path vulnerability in Wise Care 365 and Wise Disk Cleaner services.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2016-20093
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
    product: windows
    category: process_creation
detection:
    selection_root_binary:
        Image|endswith:
            - '\Program.exe'
            - '\Program Files\Wise.exe'
            - '\Program Files (x86)\Wise.exe'
    condition: selection_root_binary
falsepositives:
    - Legitimate applications named Program.exe (rare)
level: high
tags:
    - attack.privilege_escalation
    - attack.t1574.009
---
title: Unquoted Service Path Registry Check
id: 4c71d9f2-18e5-4a6b-9d0c-33e8fd27a6a1
status: experimental
description: Detects registry query events indicating reconnaissance of unquoted service paths (ImagePath values containing quotes).
logsource:
    product: windows
    category: registry_query
detection:
    selection:
        EventID: 4657
        ObjectName|contains: 'SYSTEM\CurrentControlSet\Services'
        NewValue|contains|all:
            - 'Wise'
            - ' '  # space indicates potential unquoted path
    condition: selection
level: low

YARA Rule

rule CVE_2016_20093_UnquotedServicePath_Payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects executables planted at system root path exploiting unquoted service path vuln in Wise Care 365 / Wise Disk Cleaner"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2016-20093"
        date = "2024-01-15"
        severity = "high"
    strings:
        $service_ref_1 = "WiseBootAssistant" ascii wide nocase
        $service_ref_2 = "SpyHunter" ascii wide nocase
        $admin_cmd = "net localgroup administrators" ascii wide nocase
        $reverse_shell = "cmd.exe /c" ascii wide nocase
        $persist = "currentversion\\run" ascii wide nocase
        $pe_linker = { 5A 4D }  // "MZ" header
    condition:
        $pe_linker at 0 and
        (
            $service_ref_1 or
            $service_ref_2 or
            $admin_cmd or
            $persist
        ) and filesize < 5MB
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2016-20093 - Wisecleaner Unquoted Service Path Exploitation - Reverse Shell Beacon"; flow:established,to_server; content:"|5A 4D|"; offset:0; depth:2; pcre:"/(WiseBootAssistant|SpyHunter)/i"; classtype:attempted-admin; sid:201620093; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2016-20093;)

alert http any any -> any any (msg:"CVE-2016-20093 - Wisecleaner Exploitation - Payload Download"; flow:established,to_server; content:"GET"; http_method; content:"/Program.exe"; http_uri; nocase; content:"wise"; http_uri; nocase; classtype:attempted-admin; sid:201620094; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2016-20093;)

Elastic Detection

// Detect payload executables planted at root path that would be executed by unquoted service path
process where event.category == "process" and event.action == "execution" and
  process.name in ("Program.exe", "Wise.exe") and
  process.executable : ("C:\\Program.exe", "C:\\Program Files\\Wise.exe", "C:\\Program Files (x86)\\Wise.exe") and
  process.parent.name in ("services.exe", "wininit.exe") and
  (process.code_signature.status : "unsigned" or not process.code_signature.exists)

// Detect service path registry modifications indicating unquoted path exploitation prep
registry where event.category == "registry" and
  registry.path : ("HKLM\\SYSTEM\\CurrentControlSet\\Services\\WiseBootAssistant*", "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SpyHunter*") and
  registry.data.strings : "*Wise*"

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688 
| where match(New_Process_Name, "(?i)(C:\\\\(Program\.exe|Program Files\\\\Wise\.exe|Program Files \(x86\)\\\\Wise\.exe))") 
| table _time, host, User, New_Process_Name, Parent_Process_Name 
| append [search index=windows sourcetype=WinEventLog:System EventCode=7045 (ServiceName="WiseBootAssistant" OR ServiceName="SpyHunter*") 
| table _time, host, ServiceName, ImagePath] 
| sort _time

Wazuh OSSEC Rule

<group name="windows, local_policy, cve_2016_20093,">
  <rule id="826854" level="12">
    <if_sid>550</if_sid>  <!-- Windows new process event -->
    <field name="win.eventdata.image">C:\\Program.exe|C:\\Program Files\\Wise.exe|C:\\Program Files (x86)\\Wise.exe</field>
    <description>CVE-2016-20093: Potential unquoted service path payload executed from system root (Wisecleaner)</description>
    <group>privilege_escalation,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Patch confidence is 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix is available, and no affected-version remediation guidance has been published. The vendor, Wisecleaner, has not released an updated version addressing these unquoted service paths as of the current intelligence date. This CVE remains a standing local privilege escalation risk on any system running the affected legacy versions.

Immediate Mitigations (compensating controls):

1. Eliminate the vulnerability at the source: Manually correct the service ImagePath registry entries by editing HKLM\SYSTEM\CurrentControlSet\Services\WiseBootAssistant and the corresponding SpyHunter service key. Enclose the full path in double quotes (e.g., "C:\Program Files\Wise Care 365\WiseBootAssistant.exe"). Requires administrator privileges; perform after validating the exact current path with sc qc WiseBootAssistant or reg query.
2. Restrict write access to root directories: Audit and tighten the default ACL on C:\ to remove Authenticated Users write/create permission. This is the most direct mitigation against the primary attack path (planting C:\Program.exe or C:\Program Files\Wise.exe).
3. Disable the vulnerable services: If the services are non-essential for the environment's operational continuity (WiseBootAssistant is an auto-start helper), set their startup type to Disabled via the Services MMC snap-in or sc config <ServiceName> start= disabled.
4. Remove or upgrade the application: Uninstall Wise Care 365 4.27 and Wise Disk Cleaner 9.29 from production systems. If a newer version is required for business purposes, validate that the service paths are quoted before deployment.

Patch/Upgrade Steps: No official patch exists. Monitor vendor releases and validate any future version for quoted service paths using sc qc <ServiceName>. If the products are non-essential, do not replace them with alternative vendors; instead, adopt the disabling or registry-corrective measures above.

Long-Term Hardening:

• Enforce Group Policy to standardize restrictive filesystem ACLs on C:\ and C:\Program Files / C:\Program Files (x86) across all enterprise endpoints.
• Implement a baseline configuration check: Use vulnerability scanning tools (e.g., OpenVAS, Nessus) or custom PowerShell/SCCM scripts to audit ALL Windows services for unquoted ImagePath values containing spaces on a recurring schedule.
• Deploy Microsoft's Attack Surface Reduction (ASR) rules or equivalent hardening policies that block executables launched from suspicious root-level paths.
• Adopt least-privilege operations for all end users; ensure no standard user has write access to any system root directory.
• Implement the Sigma/YARA/Elastic detection rules above in SIEM and EDR platforms to provide early-warning detection of exploitation attempts.
• Decommission legacy software: Enforce a hardware/software update lifecycle policy that retires unsupported utility applications, as the unpatched status of this CVE renders any affected system a permanent privilege escalation liability.

References

1. NVD Entry — CVE-2016-20093: https://nvd.nist.gov/vuln/detail/CVE-2016-20093 — Official NVD record with CVE description, CVSS score (8.5), and CNA attribution.
2. CNA (MITRE) Metadata: The vulnerability was assigned and titled by MITRE; the CNA title "Wise Care 365 4.27 and Wise Disk Cleaner 9.29 Unquoted Service Path Privilege Escalation" is the authoritative disclosure reference.
3. Wisecleaner Official Site: https://www.wisecleaner.com — Vendor site for monitoring of future releases; no advisory or patch published as of intelligence date.
4. MITRE CWE-428 — Unquoted Search Path or Element: https://cwe.mitre.org/data/definitions/428.html — Reference for the vulnerability class mechanism and exploitation considerations.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2016-20093 is NOT listed (KEV status: NO); no active exploitation confirmed by CISA at time of writing.

Threat Actor Activity: No known threat actor campaigns specifically targeting CVE-2016-20093 have been identified in open-source intelligence. The EPSS percentile (7.2%) reflects minimal observed exploitation attempts. However, the unquoted service path technique is routinely used by commodity malware and penetration testers alike; the absence of documented campaigns for this specific CVE should not be treated as a guarantee of safety, particularly given the unpatched status.