CVE-2020-36154

HIGH

Pearson VUE Testing System 2.3.1911 - Unauthenticated Privilege Escalation via Directory Permissions

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-36154. PoCs published by Jok3r.

AI-analyzed exploit summary This exploit leverages an unquoted service path vulnerability in Pearson Vue VTS 2.3.1911, allowing local privilege escalation to the VUEService user by placing a malicious executable in the unquoted path. The script automates detection, payload download, and system reboot to trigger execution.

Description

The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" directory, which allows local users to obtain administrative privileges via a Trojan horse application.

Exploits (1)

exploitdb WORKING POC

by Jok3r · textlocalwindows

https://www.exploit-db.com/exploits/49143

View Code ZIP pw:eip

This exploit leverages an unquoted service path vulnerability in Pearson Vue VTS 2.3.1911, allowing local privilege escalation to the VUEService user by placing a malicious executable in the unquoted path. The script automates detection, payload download, and system reboot to trigger execution.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: Pearson Vue VTS 2.3.1911

Auth required

Prerequisites: Local access to the system · Ability to write to the 'C:\Pearson VUE\' directory · VUEApplicationWrapper service running with unquoted path

MITRE ATT&CK

T1574.009 - Path Interception by Unquoted Path T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →