Vulnerability · Published May 13, 2026 · Assigned by VulnCheck
CVE-2020-37223IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation
High 7.8
In plain English
A high-severity security flaw in IObit Uninstaller from Iobit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 98.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTEM level. Attackers can place a malicious executable named IObit.exe in the C:\Program Files (x86)\IObit directory and restart the service to execute code with SYSTEM privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Iobit | IObit Uninstaller | 9.5.0.15 |
Weakness: CWE-428 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-48543 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation third-party-advisory