PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-37230 Download CVE debrief

CVE-2020-37230 describes an unquoted service path vulnerability in Syncplify.me Server! 5.0.37’s SMWebRestServicev5 service. A local attacker who can place a malicious executable in a search-path location may be able to trigger code execution with LocalSystem privileges when the service restarts or the system reboots. The issue is high impact because it can convert local access into full system-level control.

Vendor
Download
Product
Unknown
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-16
Original CVE updated
2026-05-18
Advisory published
2026-05-16
Advisory updated
2026-05-18

Who should care

Administrators and defenders responsible for Syncplify.me Server! installations, especially Windows systems running version 5.0.37 or any deployment using the affected SMWebRestServicev5 service path.

Technical summary

The issue is categorized as CWE-428 (unquoted service path). In this class of weakness, Windows may resolve a service binary path incorrectly when the path contains spaces and is not quoted, allowing execution of an attacker-controlled executable from an earlier path component. The supplied description indicates the service runs with LocalSystem privileges, so successful abuse can yield elevated code execution during service start or system reboot.

Defensive priority

High

Recommended defensive actions

  • Verify whether Syncplify.me Server! 5.0.37 is installed on any Windows hosts.
  • Inspect the SMWebRestServicev5 service configuration and confirm that the binary path is correctly quoted.
  • Apply vendor guidance or an updated build if one is available from the product vendor.
  • Restrict local write permissions on directories that could be searched before the intended service binary path.
  • Audit for unexpected executables placed near the service path and review service-start events for anomalies.
  • If remediation cannot be immediate, reduce exposure by limiting local interactive access on affected hosts.

Evidence notes

The CVE description and supplied NVD record both identify an unquoted service path issue affecting Syncplify.me Server! 5.0.37, with local privilege escalation to LocalSystem on restart or reboot. The source corpus also includes a VulnCheck advisory reference and a product download URL, but no additional technical claims are used beyond the supplied record metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2020-37230 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2020-37230

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2020-37230 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2020-37230

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.