CVE-2020-37250: TFTP Broadband Unquoted Service Path Privilege Escalation

Technical summary

CVE-2020-37250 is an unquoted service path vulnerability (CWE-428) affecting TFTP Broadband 4.3.0.1465. The tftpt.exe service binary is registered in Windows without properly quoted path arguments. This allows a local authenticated user to exploit path resolution during service startup or system reboot by creating a malicious executable in an intermediate directory within the Program Files path structure. Because the service runs under LocalSystem context, successful exploitation results in arbitrary code execution with the highest privilege level available on Windows.

Business impact

Compromise of a system running TFTP Broadband 4.3.0.1465 via this vulnerability grants attackers full administrative control. An attacker with local account access could install malware, exfiltrate data, disable security controls, or pivot to other systems on the network. The requirement for local authentication is a limiting factor, but any user account on the machine—including service accounts with minimal intended privileges—could trigger this attack path. For organizations using TFTP Broadband in production environments, successful exploitation poses a risk to data integrity, confidentiality, and availability.

Affected systems

TFTP Broadband version 4.3.0.1465 is affected. The vulnerability is local in nature, requiring an attacker to have logon access to the system where the vulnerable service is installed. The risk is highest in environments where TFTP Broadband is deployed on shared systems or where unprivileged user accounts have local access.

Exploitability

The vulnerability has a CVSS 3.1 score of 7.8 (HIGH), reflecting low attack complexity and the local attack vector requirement. Exploitation does not require user interaction and can occur passively during service restart or system reboot. However, the attacker must already possess local account credentials to place files on the system. This makes the vulnerability most dangerous in multi-user environments or scenarios where attackers have achieved initial local access through other means. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update TFTP Broadband to a patched version that properly quotes the service path. Verify the specific version number in the vendor's security advisory before deployment. Additionally, implement filesystem and registry access controls to restrict unprivileged users' ability to write to directories within Program Files. Ensure file permissions are correctly configured to prevent unauthorized executable placement.

Patch guidance

Check the TFTP Broadband vendor advisory for the first available patch version after 4.3.0.1465. Apply patches through your standard change management process. Before patching production systems, validate compatibility in a test environment. After patching, restart the tftpt.exe service or reboot the affected systems to activate the fix. Verify service startup behavior following the patch to confirm proper functionality.

Detection guidance

Monitor for suspicious executable files created in Program Files directories, particularly files with names that could be picked up by unquoted path resolution (for example, files named after partial paths or common executable names). Log and alert on service restart events for tftpt.exe. Review Windows Event Viewer security logs for failed and successful service start attempts. Check file creation timestamps relative to service start times to identify anomalous patterns. File integrity monitoring tools can detect unauthorized executables in sensitive directories.

Why prioritize this

Although TFTP Broadband 4.3.0.1465 is not yet in the CISA KEV catalog, the HIGH CVSS score (7.8) combined with local system privilege escalation capability warrants timely remediation. The attack surface is limited by the local access requirement, making this a moderate-to-high priority for systems where TFTP Broadband is deployed. Prioritize patching if the service runs on multi-user systems, shared development machines, or any endpoint where unprivileged users have logon rights.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the privilege escalation risk and the broad damage potential if exploitation occurs, while accounting for the authentication barrier required to execute the attack.

Frequently asked questions