CVE-2020-37160

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain complete system access.

CVSS v4.0

8.5 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

6.2 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.14% chance of exploitation in the next 30 days, 4th percentile

Published

2026-02-06

Updated

2026-02-17

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48070

References

• CVE Record
• NVD entry

Related

• CVE-2020-37159
• CVE-2020-37161
• CVE-2020-37158
• CVE-2020-37162
• CVE-2020-37157
• CVE-2020-37163