What is the CVSS score of CVE-2020-36938?

CVE-2020-36938 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WinAVR are affected by CVE-2020-36938?

WinAVR 20100110 contains a critical privilege escalation vulnerability (CVE-2020-36938) that allows authenticated users to modify system files and DLLs, potentially enabling attackers to execute…

Is there a public PoC exploit available for CVE-2020-36938?

Yes, a public proof-of-concept exploit is available for CVE-2020-36938. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2020-36938?

Within 24 hours: Identify all systems running WinAVR 20100110 and restrict access to the installation directory via NTFS permissions—remove write access for standard users and limit to administrators only. Within 7 days: Isolate affected systems from critical networks, disable WinAVR if not actively required, and evaluate alternative toolchains. Within 30 days: Migrate to a patched version or alternative AVR development platform; conduct forensic review of WinAVR directories on all affected systems for unauthorized modifications.

WinAVR CVE-2020-36938

HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-01-27 disclosure@vulncheck.com

Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Jan 29, 2026 - 16:31 vuln.today

Public exploit code

CVE Published

Jan 27, 2026 - 16:16 nvd

HIGH 8.8

DescriptionCVE.org

WinAVR version 20100110 contains an insecure permissions vulnerability that allows authenticated users to modify system files and executables. Attackers can leverage the overly permissive access controls to potentially modify critical DLLs and executable files in the WinAVR installation directory.

AnalysisAI

Technical ContextAI

This vulnerability (CWE-732: Incorrect Permission Assignment for Critical Resource) WinAVR version 20100110 contains an insecure permissions vulnerability that allows authenticated users to modify system files and executables. Attackers can leverage the overly permissive access controls to potentially modify critical DLLs and executable files in the WinAVR installation directory.

Affected ProductsAI

WinAVR version 20100110 contains an insecure permissions vulnerability that

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2020-36938 vulnerability details – vuln.today

Back

WinAVR CVE-2020-36938

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code