VULNERABILITY INTELLIGENCE

CVE-2020-36928

CVSS score8.5 HIGH

EPSS probability0.26%

CISA KEVNot currently listed

Published2026-01-16

Last modified2026-06-17

CVSS vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Brother\BRAgent\ to inject and execute malicious code with elevated system permissions.

Weakness classification

CWE-428: Unquoted Search Path or Element

Primary references

disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Exploit, Third Party Advisory
disclosure@vulncheck.com — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory