Vulnerability · Published May 16, 2026 · Assigned by VulnCheck
CVE-2020-37230Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation
High 7.8
In plain English
A high-severity security flaw in Syncplify.me Server! from Syncplify. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 98.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the SMWebRestServicev5 service that allows local attackers to escalate privileges by exploiting the unquoted binary path. Attackers can insert a malicious executable into the service path and execute it with LocalSystem privileges when the service restarts or the system reboots.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Syncplify | Syncplify.me Server! | 5.0.37 |
Weakness: CWE-428 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-49009 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation third-party-advisory