Matrix42 Remote Control Host 3.20.0031 has a flaw where the FastViewerRemoteService and FastViewerRemoteProxy services use an unquoted path on the system. An attacker who can write to the Program Files directory can place a malicious executable with a crafted name, which the service will run at startup, giving the attacker SYSTEM level privileges. The weakness is an unquoted service path, classified as CWE-428.

The vulnerability affects Matrix42 Remote Control Host version 3.20.0031 on Windows platforms. The services impacted are FastViewerRemoteService and FastViewerRemoteProxy.

The CVSS score of 8.5 indicates a high severity issue. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation events yet. The likely attack vector requires local user privileges or insider access; an attacker must be able to place an executable in the Program Files folder and trigger the service at startup. The lack of remote access limitations means the risk is confined to users who can modify local files.