CVE-2016-20060 HIGH

CVE-2016-20060: Hotspot Shield 6.0.3 Unquoted Service Path Privilege Escalation

Vendor Hotspotshield
Product Hotspot Shield
Weakness CWE-428
Published April 4, 2026
Last update April 6, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Hotspot Shield 6.0.3 contains an unquoted service path vulnerability in the hshld service binary that allows local attackers to escalate privileges by injecting malicious executables. Attackers can place executable files in the service path and upon service restart or system reboot, the malicious code executes with LocalSystem privileges.

Key dates

02Disclosure timeline

April 4, 2026 CVE published
April 6, 2026 Record updated