Is CVE-2020-37232 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-37232 being exploited in the wild.

How severe is CVE-2020-37232?

High severity, with a CVSS score of 7.8, published 16 May 2026.

Which products and versions are affected?

IObit Advanced SystemCare 13.0.0.157 and earlier.

Is there a fix for CVE-2020-37232?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-37232 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2020-37232?

Check whether you run IObit Advanced SystemCare at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37232: IObit Advanced SystemCare unquoted service path privilege escalation

CVE-2020-37232 · Severity: high · CVSS 7.8 · Published 2026-05-16

IObit Advanced SystemCare is a utility suite used to optimize and clean Windows computers. A security flaw in how the software starts its background service allows a local user with limited permissions to gain full administrative control of the system. This could lead to complete system takeover, data theft, or the installation of persistent malware that survives system reboots.

Vendors: IObit.

Quick answers

Is CVE-2020-37232 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-37232 being exploited in the wild.
How severe is CVE-2020-37232?: High severity, with a CVSS score of 7.8, published 16 May 2026.
Which products and versions are affected?: IObit Advanced SystemCare 13.0.0.157 and earlier.
Is there a fix for CVE-2020-37232?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-37232 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2020-37232?: Check whether you run IObit Advanced SystemCare at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The AdvancedSystemCareService13 service binary path is stored as an unquoted string containing spaces (e.g., C:\Program Files (x86)\Advanced SystemCare Pro\ASCService.exe). Due to how Windows handles service execution, a local attacker with write permissions to the system root or intermediate directories can place a malicious executable (such as C:\Program.exe) to be executed instead of the legitimate service. This occurs during service startup or system reboot, granting the attacker's code LocalSystem privileges. The vulnerability is classified as CWE-428.

Affected products

IObit Advanced SystemCare Service 13 13.0.0.157 and earlier

Timeline

2020-11-10: disclosed: Initial discovery by researcher
2020-11-16: other: Exploit published on Exploit-DB
2026-05-16: advisory: NVD/VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.