📄 Description (English)
Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSystem permissions.
🤖 AI Executive Summary
CVE-2020-36987 is a privilege escalation vulnerability in Program Access Controller 1.2.0.0 affecting the PACService.exe service through an unquoted service path. Local attackers can inject malicious executables during system startup to achieve code execution with LocalSystem privileges. While no public exploit is available, the vulnerability poses significant risk to organizations using this software, particularly in critical infrastructure environments.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 27, 2026 10:33
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability primarily impacts Saudi government agencies, critical infrastructure operators (ARAMCO, SEC), and financial institutions using Program Access Controller for access management. The LocalSystem privilege escalation capability poses severe risk to SCADA/ICS environments in energy sector and administrative systems in government entities under NCA oversight. Banking sector systems (SAMA-regulated) using this software for access control are at elevated risk of unauthorized system compromise.
🏢 Affected Saudi Sectors
Government
Energy (ARAMCO, SEC)
Banking (SAMA-regulated institutions)
Critical Infrastructure
Healthcare
Telecommunications
🎯 MITRE ATT&CK Techniques
T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1547.011 - Boot or Logon Autostart Execution: Services
T1134.003 - Access Token Manipulation: Make and Impersonate Token
T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt
T1574.008 - Hijack Execution Flow: DLL Search Order Hijacking
T1036.003 - Masquerading: Rename System Utilities
T1053.005 - Scheduled Task/Job: Scheduled Task
⚖️ Saudi Risk Score (AI)
7.2
/ 10.0
🔧 Remediation Steps (English)
1. IMMEDIATE ACTIONS:
- Identify all systems running Program Access Controller 1.2.0.0 across your infrastructure
- Restrict local access to affected systems through network segmentation and access controls
- Monitor for suspicious process creation from PACService.exe context
2. PATCHING:
- Upgrade Program Access Controller to version 1.2.0.1 or later immediately
- Test patches in non-production environment before deployment
- Prioritize critical infrastructure and government systems
3. COMPENSATING CONTROLS (if patching delayed):
- Implement file integrity monitoring on system directories and service paths
- Apply principle of least privilege to service account permissions
- Disable unnecessary local user accounts and enforce strong password policies
- Use AppLocker/Windows Defender Application Control to restrict executable execution
4. DETECTION:
- Monitor Event Viewer for service start/stop events (Event ID 7045)
- Alert on suspicious file creation in Program Files directories
- Track process execution with parent process PACService.exe
- Implement YARA rule: detect_unquoted_service_path_exploitation
🔧 خطوات المعالجة (العربية)
1. الإجراءات الفورية:
- تحديد جميع الأنظمة التي تقوم بتشغيل Program Access Controller 1.2.0.0 عبر البنية التحتية
- تقييد الوصول المحلي للأنظمة المتأثرة من خلال تقسيم الشبكة والتحكم في الوصول
- مراقبة إنشاء العمليات المريبة من سياق PACService.exe
2. التصحيح:
- ترقية Program Access Controller إلى الإصدار 1.2.0.1 أو أحدث فوراً
- اختبار التصحيحات في بيئة غير الإنتاج قبل النشر
- إعطاء الأولوية للبنية التحتية الحرجة والأنظمة الحكومية
3. الضوابط البديلة (إذا تأخر التصحيح):
- تطبيق مراقبة سلامة الملفات على أدلة النظام ومسارات الخدمة
- تطبيق مبدأ أقل امتياز على أذونات حساب الخدمة
- تعطيل حسابات المستخدمين المحليين غير الضرورية وفرض سياسات كلمات مرور قوية
- استخدام AppLocker/Windows Defender Application Control لتقييد تنفيذ الملفات
4. الكشف:
- مراقبة Event Viewer لأحداث بدء/إيقاف الخدمة (معرف الحدث 7045)
- التنبيه على إنشاء ملفات مريبة في أدلة Program Files
- تتبع تنفيذ العملية مع عملية الوالد PACService.exe
- تطبيق قاعدة YARA: detect_unquoted_service_path_exploitation
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
A.5.1.1 - Information security policies and procedures
A.5.2.1 - User access management
A.5.2.2 - Privileged access rights
A.5.2.3 - User access review
A.5.3.1 - Password management
A.8.1.1 - User endpoint devices
A.8.2.1 - Privileged access rights
A.8.2.2 - Sensitive system isolation
🔵 SAMA CSF
ID.AM-2 - Software inventory and management
PR.AC-1 - Access control policy and procedures
PR.AC-4 - Access rights and privileges
DE.CM-3 - Activities monitored and detected
RS.MI-2 - Incidents are mitigated
🟡 ISO 27001:2022
A.5.1.1 - Policies for information security
A.5.2.1 - User registration and de-registration
A.5.2.2 - User access provisioning
A.5.2.3 - Management of privileged access rights
A.5.3.1 - Password management
A.8.1.1 - User endpoint devices
A.8.2.1 - Privileged access rights
A.8.2.3 - Information access restriction
🟣 PCI DSS v4.0.1
2.1 - Default security parameters
2.2.4 - Configure system security parameters
6.2 - Security patches and updates
7.1 - Limit access to system components
8.1 - User identification and authentication