CVE-2016-20060

8.5 highEPSS 0.2%

Hotspot Shield 6.0.3 contains an unquoted service path vulnerability in the hshld service binary that allows local attackers to escalate privileges by injecting malicious executables. Attackers can place executable files in the service path and upon service restart or system reboot, the malicious code executes with LocalSystem privileges.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
CWE: CWE-428
Published: 2026-04-04
Modified: 2026-07-20
Record from: the NVD, synced 2026-10-19

References

https://www.exploit-db.com/exploits/40528
https://www.hotspotshield.com
https://www.hotspotshield.com/download/
https://www.vulncheck.com/advisories/hotspot-shield-unquoted-service-path-privilege-escalation

Check your stack JSON