Skip to content
Fencer Vulns
high 8.0

CVE-2020-15261 in the critical feed json

Unquoted service path vulnerability on Veyon

published 2020-10-19 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-7270

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
11.3%
EPSS 11.3% chance of exploitation in 30 days, percentile 95%
public exploits
1
Exploit-DB

Summary

On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.

Patch / fix

  • veyon veyon 4.4.2

Timeline

  1. Published
  2. First public exploit (EDB-49925)

Exploit prediction

11.25% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-49925 Veyon 4.4.1 - 'VeyonService' Unquoted Service Path local, 2021-06-01
  • packetstormsecurity.com http://packetstormsecurity.com/files/162873/Veyon-4.4.1-Unquoted-Service-Path.html referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com https://www.exploit-db.com/exploits/48246 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • veyon veyon

Classification

Weakness
  • CWE-428 Unquoted Search Path or Element

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.