CVE-2016-20095: Matrix42 Remote Control Host Privilege Escalation via Unquoted Service Path

Technical summary

The vulnerability stems from improper handling of file paths in service configuration for Matrix42's remote control solution. The affected services do not properly quote their executable paths, creating a classic Windows privilege escalation vector. An authenticated local user can craft a malicious executable with a name matching the unquoted path prefix and place it in a directory the service searches during startup. For example, if a service path reads C:\Program Files\Matrix42\Service.exe without quotes, an attacker could place a malicious executable at C:\Program Files\Matrix42.exe (exploiting the space in "Program Files") that executes before the legitimate service. This results in code execution under the SYSTEM account.

Business impact

Successful exploitation grants an attacker SYSTEM-level privileges on affected machines, enabling complete system compromise. This is particularly dangerous in enterprise environments where Matrix42 Remote Control Host is deployed for IT support and asset management. An attacker could establish persistent backdoors, exfiltrate sensitive data, disable security controls, or move laterally across the network using compromised administrative credentials. The impact extends beyond individual endpoints to organizational-wide risk if the tool is widely deployed.

Affected systems

Matrix42 Remote Control Host version 3.20.0031 is confirmed vulnerable. Organizations should verify whether this specific version is in use across their infrastructure. The vulnerability requires local system access to exploit, so it is most relevant in environments where endpoint security and user isolation controls may be weaker, such as shared workstations or systems where users have unrestricted write access to Program Files directories.

Exploitability

Exploitation requires local system access with user-level privileges and the ability to write to the Program Files directory or other locations in the service's search path. No authentication bypass or network exploitation is involved. The attack is deterministic—once a malicious executable is placed in the correct location, execution occurs automatically upon service restart. While this is not a remote vulnerability, the barrier to exploitation is low for any authenticated user with basic file system access, making it relevant in multi-user or compromised endpoint scenarios.

Remediation

Immediately upgrade Matrix42 Remote Control Host to a patched version that resolves the unquoted service path issue. Consult Matrix42's official security advisory for specific patch version numbers and deployment guidance. As an interim control, restrict write access to the Program Files directory and service directories to administrators only. Monitor service startup behaviors and audit local user accounts for unexpected executable files in sensitive directories.

Patch guidance

Contact Matrix42 directly or review their security advisory for the recommended patched version that supersedes 3.20.0031. Patches should be tested in a non-production environment before broad deployment. Given that this affects core remote control services, coordinate patching with change management processes to minimize operational disruption. Verify patch installation by confirming the service path is now properly quoted in the Windows Registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services).

Detection guidance

Monitor for unusual executable files created in the Program Files directory that do not correspond to known software installations. Check the Windows Registry for service entries with unquoted paths—this can be automated using PowerShell or third-party endpoint scanning tools. Review service startup event logs (Windows Event Viewer, System channel) for unexpected service restarts or execution patterns. Endpoint detection and response (EDR) solutions should flag suspicious processes spawned from service startup contexts with SYSTEM privileges.

Why prioritize this

This vulnerability warrants prompt remediation despite requiring local access because (1) it enables direct privilege escalation to SYSTEM, (2) affected software is deployed enterprise-wide for remote management, (3) internal threat actors or compromised accounts can easily exploit it, and (4) the attack is difficult to detect without proper monitoring. The high CVSS score of 7.8 reflects the severity of full system compromise.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH severity) reflects a high-impact vulnerability with low attack complexity and low privileges required. The attack vector is local (AV:L) because physical or remote access is not required—only existing user-level login is needed. Attack complexity is low (AC:L) because exploitation does not require specialized tools or timing. The impact is complete across all CIA triad dimensions: confidentiality, integrity, and availability are all rated high (C:H, I:H, A:H) due to SYSTEM-level code execution. The scope is unchanged (S:U) because the impact is limited to the affected system.

Frequently asked questions