CVE-2020-36879
High
Description
Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startup or reboot with escalated privileges. Attackers can exploit the unquoted service path vulnerability by specifying a malicious service name in the 'sc qc' command, allowing them to execute arbitrary system commands.
SeverityHigh
CVSS8.5
Exploit probability—
ProductDiskBoss
PublishedDec 5, 2025
First seenDec 5, 2025
Weakness typeCWE-428CWE-428
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Flexsense DiskBoss | 11.7.28 | — |
| Flexsense DiskBoss Pro | 11.7.28 | — |
| Flexsense DiskBoss Ultimate | 11.7.28 | — |
| Flexsense DiskBoss Server | 11.7.28 | — |
| Flexsense DiskBoss Enterprise | 11.7.28 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.