Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path

published 2026-03-15 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2017-18930

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits: 0; none known

Serviio PRO 1.8 contains an unquoted search path vulnerability in the Windows service that allows local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path. Additionally, improper directory permissions with full access for the Users group allow authenticated users to replace the executable file with arbitrary binaries, enabling privilege escalation during service startup or system reboot.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 7 mo ago (2026-03-16)

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

exploit-db.com https://www.exploit-db.com/exploits/41959/ referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com https://packetstormsecurity.com/files/142384 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Serviio Serviio PRO

Classification

Weakness

CWE-428 Unquoted Search Path or Element

References

exploit-db.com /exploits/41959/
exploit
packetstormsecurity.com /files/142384
exploit
zeroscience.mk /en/vulnerabilities/ZSL-2017-5405.php
third-party-advisory
blogs.securiteam.com /index.php/archives/3094
third-party-advisory
cxsecurity.com /issue/WLB-2017050019
third-party-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/125644
vdb-entry
vulncheck.com /advisories/serviio-pro-local-privilege-escalation-via-unquoted-path
third-party-advisory

Sources

CVE List CVE-2017-20218
NVD CVE-2017-20218

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary