CVE-2016-20093: Unquoted Service Path Privilege Escalation in Wise Care 365 and Wise Disk Cleaner

Technical summary

This vulnerability stems from unquoted service paths in the WiseBootAssistant service (Wise Care 365) and the SpyHunter 4 Service (Wise Disk Cleaner). When a service path is not enclosed in quotes and contains spaces, Windows searches for and executes the first matching executable it finds in the path hierarchy. An attacker with local user privileges can exploit this by creating a specially-named executable in a directory that appears earlier in the search order—typically the system root or another world-writable location. The vulnerability is classified as CWE-428 (Unquoted Search Path or Element), a well-known local privilege escalation vector. Upon service initialization or system restart, the malicious executable runs with SYSTEM-level privileges, bypassing standard user account restrictions.

Business impact

Successful exploitation allows an attacker with any local user account on an affected system to gain SYSTEM privileges, effectively owning the machine. This enables data theft, malware installation, lateral movement within the network, ransomware deployment, and persistent backdoor establishment. For organizations using Wise Care 365 or Wise Disk Cleaner on workstations, servers, or administrative systems, this represents a significant privilege escalation risk. The impact is particularly severe if these utilities are deployed on systems handling sensitive data or critical infrastructure.

Affected systems

Wise Care 365 version 4.27 and Wise Disk Cleaner version 9.29 are explicitly affected. The vulnerability requires local system access and affects any Windows system running these specific versions or potentially earlier versions with the same unquoted service path issue. Organizations should verify whether affected versions are present in their environment and determine if later patched versions exist from the vendors.

Exploitability

The vulnerability is straightforward to exploit given local access. The attacker does not need elevated privileges to begin the attack, only a standard user account. Exploitation does not require user interaction or system network connectivity. The complexity is low because the Windows service path resolution mechanism is deterministic and well-documented. However, practical exploitation depends on the attacker having write access to the relevant directories and knowledge of when the service will be restarted. The CVSS score of 7.8 reflects the high impact of SYSTEM privilege execution combined with the relatively low attack complexity.

Remediation

Update Wise Care 365 and Wise Disk Cleaner to versions that contain properly quoted service paths. Organizations should verify the availability of patched versions from Wise (Wisecleaner Inc.) and deploy them through standard patch management processes. Until patches are available or deployed, mitigating controls include restricting local user account creation, enforcing strong account and password policies, and preventing execution of programs from the system root or other world-writable locations through application whitelisting or executable restrictions.

Patch guidance

Check the vendor advisory and security update information from Wise (Wisecleaner Inc.) to identify patched versions that address the unquoted service path issue. Patches should be tested in a non-production environment before organization-wide rollout. The update process typically involves uninstalling the affected version and installing the latest available release. After patching, verify that service paths are properly quoted in the Windows service registry entries (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services). System restart may be required to fully apply the patch and ensure the corrected service configuration is active.

Detection guidance

Review the service configuration of affected systems by querying the Windows Registry or using the Get-Service and Get-CimInstance PowerShell cmdlets to inspect the ImagePath value of WiseBootAssistant and SpyHunter 4 Service entries. Unquoted paths will appear without double quotes around the full executable path. Search for suspicious executable files in system root directories (C:\) and other common locations that might be weaponized for this attack. Monitor service startup events in Windows Event Viewer (System log, Event ID 7000-7009) for unexpected executable execution. Endpoint detection and response (EDR) solutions should flag suspicious service execution or file creation in sensitive directories by non-administrative processes.

Why prioritize this

This vulnerability merits prompt attention because it provides a direct path to SYSTEM privilege escalation on affected systems without requiring user interaction or network access. Any local user—including those with minimal system privileges—can exploit it. The affected products are system maintenance utilities likely deployed across multiple workstations in many organizations. The combination of ease of exploitation, high impact, and potential prevalence justifies treating this as a near-term remediation priority, particularly for systems with multiple user accounts or shared access.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (AV:L) because local system access is required; Attack Complexity Low (AC:L) because standard path resolution mechanisms are exploited; Privileges Required Low (PR:L) because a standard user account suffices; User Interaction None (UI:N) because the attack is automatic upon service restart; Scope Unchanged (S:U) because the impact is confined to the affected system; and all three impact metrics (Confidentiality, Integrity, Availability) rated High (C:H/I:H/A:H) because SYSTEM-level code execution grants complete system compromise. The score appropriately captures the serious local privilege escalation risk.

Frequently asked questions