Wacom WTabletService Unquoted Service Path Vulnerability Allowing Elevated Privileges

A vulnerability exists in Wacom WTabletService version 6.6.7-3, where an unquoted service path allows local attackers to execute malicious code with elevated privileges. By placing an executable file in the service path, unauthorized code can be executed when the service is restarted or the system is rebooted.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution with elevated privileges.

Reproduction

The vulnerability can be reproduced by inserting an executable file into the unquoted service path of 'WTabletServicePro'. This can be done using a variety of methods to place the executable in the correct location. Once the file is in place, restarting the 'WTabletServicePro' service or rebooting the system will execute the malicious code with elevated privileges.