CVE-2016-20087

Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting the service binary path. Attackers can insert malicious executables in the system root path that execute with SYSTEM privileges during service startup or system reboot.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.networkdls.com/
http://www.networkdls.com/Software/View/Fortitude_HTTP
https://www.exploit-db.com/exploits/40461
https://www.vulncheck.com/advisories/fortitude-http-unquoted-service-path-elevation-of-privilege

Configurations

No configuration.

History

29 Sep 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Fortitude HTTP 1.0.4.0 contiene una vulnerabilidad de ruta de servicio sin comillas que permite a usuarios locales ejecutar código arbitrario con privilegios elevados al explotar la ruta del binario del servicio. Los atacantes pueden insertar ejecutables maliciosos en la ruta raíz del sistema que se ejecutan con privilegios de SYSTEM durante el inicio del servicio o el reinicio del sistema.

Information

Published : 2026-06-19 15:16

Updated : 2026-09-29 09:10

NVD link : CVE-2016-20087

Mitre link : CVE-2016-20087

CVE.ORG link : CVE-2016-20087

JSON object : View

Products Affected

No product.

CWE

CWE-428

Unquoted Search Path or Element

{"id": "CVE-2016-20087", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2016-20087", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T16:38:12.862948Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Networkdls", "product": "Fortitude HTTP", "versions": [{"status": "affected", "version": "1.0.4.0"}]}]}], "published": "2026-06-19T15:16:32.403", "references": [{"url": "http://www.networkdls.com/", "source": "disclosure@vulncheck.com"}, {"url": "http://www.networkdls.com/Software/View/Fortitude_HTTP", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/40461", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/fortitude-http-unquoted-service-path-elevation-of-privilege", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting the service binary path. Attackers can insert malicious executables in the system root path that execute with SYSTEM privileges during service startup or system reboot."}, {"lang": "es", "value": "Fortitude HTTP 1.0.4.0 contiene una vulnerabilidad de ruta de servicio sin comillas que permite a usuarios locales ejecutar c\u00f3digo arbitrario con privilegios elevados al explotar la ruta del binario del servicio. Los atacantes pueden insertar ejecutables maliciosos en la ruta ra\u00edz del sistema que se ejecutan con privilegios de SYSTEM durante el inicio del servicio o el reinicio del sistema."}], "lastModified": "2026-09-29T09:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}