CVE-2020-37252

Executive Summary

CVE-2020-37252 is a local privilege escalation vulnerability in Realtek Audio Service version 1.0.0.55, stemming from an unquoted service path in the executable RtkAudioService64.exe. An authenticated local attacker with the ability to write files to directories on the Windows system drive can plant a malicious executable that the Windows Service Control Manager will execute with LocalSystem privileges when the service starts or the system reboots. The vulnerability carries a CVSS score of 8.5, is confirmed unpatched as of this report, and poses a significant risk to endpoints running this audio driver package.

Technical Analysis

The vulnerability is rooted in how the Windows Service Control Manager (SCM) resolves the path to the service executable. On Windows, when a service is registered with a path to an executable that is not surrounded by quotation marks, the SCM attempts to interpret the string as a file path with potential embedded spaces. For example, if the service binary path is registered as:

C:\Program Files\Realtek\Audio\Driver\RtkAudioService64.exe

the SCM will interpret this in a "best guess" fashion, attempting the following resolutions in sequence:

1. C:\Program.exe
2. C:\Program Files\Realtek.exe
3. C:\Program Files\Realtek\Audio.exe
4. C:\Program Files\Realtek\Audio\Driver\RtkAudioService64.exe

If an attacker can create a file named Program.exe in the root of C:\, or Realtek.exe in C:\Program Files\, the SCM will execute that malicious file instead of the intended service binary. Because services traditionally run under the LocalSystem account (the highest-privileged built-in Windows account), any code executed this way inherits SYSTEM privileges.

The attack surface is limited to local users who have write permissions to any directory along the unquoted path. In many default Windows configurations, standard users can write to the root of C:\ (depending on UAC and folder permissions), or to subdirectories within C:\Program Files\ where group/user write permissions may be looser. The exploitation does not require network access, user interaction beyond a reboot/service restart, or any authentication beyond a valid local user account.

The vulnerability is classified under CWE-428 (Unquoted Search Path or Element). The CVSS vector reflects a local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and significant scope change (S:C) because the attacker escalates from a limited user context to SYSTEM. The integrity and availability impacts are complete (C:H/I:H/A:H).

Exploitation Scenarios

Scenario 1: Standard User to SYSTEM via Reboot

1. Reconnaissance: Attacker enumerates installed services to locate an unquoted service path referencing RtkAudioService64.exe. This can be done via sc qc commands, WMI queries, or inspecting the registry key HKLM\SYSTEM\CurrentControlSet\Services. Realtek Audio Service is commonly present on systems with Realtek onboard audio hardware — notably most consumer laptops and desktops running Windows.

2. Flaw Trigger: The attacker identifies that the service binary is installed without quotes. They then check write permissions on directories along the path (e.g., C:\, C:\Program Files\).

3. Payload Delivery: The attacker compiles a small executable (e.g., a reverse shell or a payload that adds the attacker to the local Administrators group) and places it as C:\Program.exe (or another position along the path).

4. Execution: The attacker reboots the machine (or triggers a service restart if permitted) and the SCM resolves C:\Program.exe first, executing the payload with LocalSystem privileges.

5. Post-Exploitation: The attacker gains full control of the endpoint — can install persistent backdoors, harvest credentials, disable security tooling, or use the compromised host as a pivot point in the network.

Scenario 2: Persistence Through Service Failure

If the service fails to start due to the payload crash (but the attacker code executes first), the SCM may retry starting the service, allowing repeated execution of the payload. Attackers can also chain this with other persistence mechanisms to survive reboots.

PoC Status: No public proof-of-concept or exploit code has been identified at the time of publication. The attack chain described above is inferred from the unquoted service path vulnerability class and standard Windows service hijacking techniques.

Impact Assessment

Business Impact: Successful exploitation results in complete compromise of the affected Windows endpoint. Since the payload executes as LocalSystem, an attacker gains the highest privilege level on the local machine, enabling them to bypass all local security controls, read arbitrary files (including credentials, secrets, and other users' data), install kernel-level rootkits, and disable endpoint detection and response (EDR) products.

Affected Systems: Any Windows machine running Realtek Audio Service version 1.0.0.55. This is a peripheral driver component shipped with many OEM systems (Dell, HP, Lenovo, ASUS, etc.) and can also be independently installed from the Realtek website or driver update packages. The vulnerability is highly prevalent given the ubiquity of Realtek audio hardware.

Blast Radius: While exploitation requires local access, the impact is severe — a single compromised user account can become SYSTEM. In enterprise environments, this could provide an attacker with a foothold to move laterally using stolen credentials or by leveraging additional vulnerabilities. The CVSS score of 8.5 (High) reflects this combination of low complexity and catastrophic impact.

Detection Guidance

Sigma Rule

title: Realtek Audio Service Unquoted Path Privilege Escalation
status: experimental
description: Detects creation of executables in directories matching the unquoted service path pattern for RtkAudioService64.exe
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-37252
tags:
    - attack.execution
    - attack.t1574
logsource:
    category: file_event
    product: windows
detection:
    selection_suspicious_paths:
        TargetFilename|endswith:
            - ':\Program.exe'
            - ':\Program Files\Realtek.exe'
            - ':\Program Files\Realtek\Audio.exe'
        Image|contains:
            - 'cmd.exe'
            - 'powershell.exe'
            - 'wscript.exe'
            - 'cscript.exe'
    filter_trusted_installer:
        Image: 'C:\Windows\servicing\TrustedInstaller.exe'
    condition: selection_suspicious_paths and not filter_trusted_installer
level: high
falsepositives:
    - Microsoft Windows installer (TrustedInstaller) during OS updates
    - Legitimate software installation in Program Files root

YARA Rule

rule CVE_2020_37252_Unquoted_Service_Path_Mimicry
{
    meta:
        author = "valtersit.com"
        description = "Detects PE files staged in directories matching the unquoted path hijack positions for Realtek Audio Service"
        date = "2025-01-01"
        cve = "CVE-2020-37252"
        severity = "high"
    strings:
        $mz = { 4D 5A 90 00 }  // MZ header
        $pdb_realtek = "RtkAudioService" ascii nocase
        $susp_path_1 = "\\Program.exe" ascii nocase
        $susp_path_2 = "\\Realtek.exe" ascii nocase
        $susp_path_3 = "\\Audio.exe" ascii nocase
        $shell_execute = "CreateProcess" ascii nocase
        $net_api = "NetUserAdd" ascii nocase
        $service_start = "StartService" ascii nocase
    condition:
        $mz at 0 and (
            ($susp_path_1 or $susp_path_2 or $susp_path_3) and
            (1 of ($shell_execute, $net_api, $service_start) or $pdb_realtek)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2020-37252 Realtek Audio Service Unquoted Path Exploitation - Suspicious PE Download"; flow:established,to_client; file_data; content:"MZ"; within:2; fileext:"exe"; threshold:type limit, track by_src, count 1, seconds 60; sid:1000372; rev:1; reference:cve,2020-37252; metadata:attack_target Windows, service http, created_at 2025_01_01, updated_at 2025_01_01;)

# Note: This vulnerability is a local privilege escalation vector requiring local file placement.
# Network detection is limited; monitor for SMB/CIFS uploads of suspicious executables to writable shares
# that could be leveraged via remote path injection.
alert smb any any -> $HOME_NET any (msg:"CVE-2020-37252 Realtek Audio Unquoted Path - Suspicious Executable Written via SMB"; content:"|FF 53 4D 42|"; flow:established,to_server; content:"|2E 00|Program.exe"; nocase; sid:1000373; rev:1; reference:cve,2020-37252;)

Elastic Detection

sequence by host.name, user.name
  [ file where event.type == "creation" and
    file.path : ("C:\\Program.exe", "C:\\Program Files\\Realtek.exe",
                 "C:\\Program Files\\Realtek\\Audio.exe") and
    not process.name : "TrustedInstaller.exe"
  ]
  [ process where process.name == "services.exe" and
    event.type == "start"
  ]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| search (EventCode=4688 AND Process_Name IN ("C:\\Program.exe", "C:\\Program Files\\Realtek.exe", "C:\\Program Files\\Realtek\\Audio.exe"))
   OR (EventCode=11 AND TargetFilename IN ("C:\\Program.exe", "C:\\Program Files\\Realtek.exe", "C:\\Program Files\\Realtek\\Audio.exe"))
| eval privilege_escalation_indicator=if(Process_Name LIKE "%Program.exe%" AND Process_Name NOT LIKE "%TrustedInstaller%", "YES", "NO")
| table _time, host, User, Process_Name, TargetFilename, New_Process_ID
| sort - _time

Wazuh OSSEC Rule

<rule id="100372" level="12">
    <decoded>win_creation_file</decoded>
    <field name="win.event.type">creation</field>
    <if_sid>100222</if_sid>
    <regex>\\Program\.exe|\\Realtek\.exe|\\Audio\.exe</regex>
    <description>CVE-2020-37252 Realtek Audio Service - Suspicious executable placed in unquoted service path directory</description>
    <group>exploitation,privilege_escalation,sysmon_event_11,</group>
    <mitre>
        <id>T1574</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Status: CVE-2020-37252 is UNPATCHED as of this report (patch confidence 0/4). No vendor advisory, fix version, or workaround has been published by Realtek. The following recommendations are provided as defense-in-depth measures.

Immediate Mitigations (no vendor fix required):

1. Manually quote the service path: As an administrator, edit the service registry key HKLM\SYSTEM\CurrentControlSet\Services\RtkAudioService and modify the ImagePath value to include quotation marks: "C:\Program Files\Realtek\Audio\Driver\RtkAudioService64.exe".
2. Restrict write permissions: Audit and tighten NTFS permissions on C:\ and C:\Program Files\ to prevent standard users from creating new files or modifying existing ones in the root-level directories.
3. Disable the service if not needed: If audio functionality is provided by an alternative driver or if the service is not strictly required, disable it (sc config RtkAudioService start= disabled) to eliminate the attack surface.

Patch/Upgrade Steps:

4. Monitor Realtek's official download portal and third-party driver repositories (e.g., Windows Update Catalog, OEM support sites) for an updated version of the Realtek Audio Service. Upgrade to any version newer than 1.0.0.55 when available, and verify the service path is properly quoted post-upgrade.
5. For enterprise fleets, use endpoint management tools (SCCM, InTune, or similar) to centrally apply the registry fix and track compliance across all endpoints.

Long-Term Hardening:

6. Implement Application Control (WDAC/AppLocker) to restrict execution of unsigned binaries in system paths.
7. Enable Attack Surface Reduction rules for credential stealing and persistence techniques.
8. Perform periodic audit of all Windows services to identify unquoted paths using automated scanning tools (e.g., PowerShell queries against the Services registry key).
9. Maintain robust log aggregation from Sysmon (Event ID 11 — FileCreate), Windows Security auditing, and host firewall logs to support the detection queries above.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2020-37252
2. CWE-428 (Unquoted Search Path or Element): https://cwe.mitre.org/data/definitions/428.html
3. MITRE ATT&CK — Hijack Execution and Support (T1574): https://attack.mitre.org/techniques/T1574/
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2020-37252 not listed — no confirmed exploitation in the wild as of this report)

Threat Actor Campaigns: No known threat actor campaigns have been publicly attributed to exploitation of CVE-2020-37252. The EPSS score of 0.00173 (7.0% percentile) indicates an extremely low probability of in-the-wild exploitation, likely due to the vulnerability's local-access requirement and the existence of more convenient privilege escalation alternatives. Nonetheless, the unpatched status and high CVSS score make this a latent risk for targeted insider-threat scenarios or post-exploitation persistence chains on newly compromised hosts.