High severity · published Dec 5, 2025
CVE-2020-36879
Flexsense DiskBoss Service Unquoted Service Path Vulnerability
8.5
CVSS
0.3%
EPSS
No
On KEV
Description
Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startup or reboot with escalated privileges. Attackers can exploit the unquoted service path vulnerability by specifying a malicious service name in the 'sc qc' command, allowing them to execute arbitrary system commands.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
DiskBoss · Flexsense
11.7.28 · source: vendor
DE
DiskBoss Enterprise · Flexsense
11.7.28 · source: vendor
DP
DiskBoss Pro · Flexsense
11.7.28; 11.7.28 · source: vendor
DS
DiskBoss Server · Flexsense
11.7.28 · source: vendor
DU
DiskBoss Ultimate · Flexsense
11.7.28; 11.7.28 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36879
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36879
www.diskboss.com
https://www.diskboss.com/
www.diskboss.com
https://www.diskboss.com/downloads.html
www.exploit-db.com
https://www.exploit-db.com/exploits/49022
www.vulncheck.com
https://www.vulncheck.com/advisories/flexsense-diskboss-service-unquoted-service-path-vulnerability
More from DiskBoss
7.8
CVE-2020-36881
Flexsense DiskBoss 'Add Input Directory' Buffer Overflow
7.8
CVE-2020-36880
Flexsense DiskBoss 'Reports and Data Directory' Buffer Overflow
7.5
CVE-2020-36882
Flexsense DiskBoss Application Crash Denial of Service