What’s Vulnerable › Vulnerabilities

CVE-2020-15264: Privilege Escalation in Boxstarter

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-20 · updated 2026-06-17
• Weakness: CWE-73

Description

The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking for. For example, WptsExtensions.dll When Windows starts, it'll execute the code in DllMain() with SYSTEM privileges. Any unprivileged user can execute code with SYSTEM privileges. The issue is fixed in version 3.13.0

Affected products

• chocolatey boxstarter: before 2.13.0 — fixed in 2.13.0

How to fix

Upgrade to a fixed version: chocolatey boxstarter 2.13.0. Check the vendor advisory for mitigations.

References

• https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633
• https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf
• https://www.kb.cert.org/vuls/id/208577
• https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633
• https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf
• https://www.kb.cert.org/vuls/id/208577

Get alerted when CVE-2020-15264 or the next vulnerability affects your stack