OKI sPSV Port Manager: Local Privilege Escalation via Unquoted Path

title: CVE-2020-37229 - OKI sPSV Port Manager Unquoted Service Path Privilege Escalation
id: scw-2026-05-16-ai-1
status: experimental
level: critical
description: |
  Detects the execution of the OKI sPSV Port Manager service (sPSVOpLclSrv.exe) when its path contains a space or other special character that could be exploited by an attacker placing a malicious executable in a subdirectory. This rule specifically targets the unquoted service path vulnerability (CVE-2020-37229) allowing for local privilege escalation.
author: SCW Feed Engine (AI-generated)
date: 2026-05-16
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2020-37229/
tags:
  - attack.privilege_escalation
  - attack.t1574.001
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files (x86)\OKI\sPSV Port Manager\sPSVOpLclSrv.exe'
      ParentImage|startswith:
          - 'C:\Windows\System32\svchost.exe'
      CommandLine|contains:
          - 'C:\Program Files (x86)\OKI\sPSV Port Manager\sPSVOpLclSrv.exe'
  selection_base:
      Image|startswith:
          - 'C:\Program Files (x86)\OKI\sPSV Port Manager\'
  selection_indicators:
      Image|endswith:
          - '.exe'
      Image|startswith:
          - 'C:\Program Files (x86)\OKI\sPSV Port Manager\'
      Image|contains:
          - '\\'
  condition: selection AND selection_base AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse