Zilab Remote Console Server Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in Zilab Remote Console Server version 3.2.9 due to an unquoted service path. This flaw allows local attackers to execute arbitrary code with elevated privileges. Exploitation involves injecting malicious executables into the unquoted binary path of the service, which are then executed with LocalSystem rights.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with elevated system privileges, potentially allowing for significant changes to the system or application.

Reproduction

The vulnerability can be reproduced by exploiting the unquoted service path of the 'zrcs' service. After injecting a malicious executable into the service's binary path, the executable will be executed with LocalSystem privileges.