Brother BRPrint Auditor Unquoted Service Path Vulnerability Allowing Privilege Escalation

A vulnerability exists in Brother BRPrint Auditor version 3.0.7 due to unquoted service paths in its Windows service configurations. This flaw allows local attackers to execute arbitrary code by injecting malicious executables into the exploited services, BrAuSvc and BRPA_Agent, potentially leading to elevated privileges on the system.

Impact

Exploitation of this vulnerability could allow local attackers to execute arbitrary code with elevated privileges.

Reproduction

The vulnerability can be reproduced by installing Brother BRPrint Auditor 3.0.7 on a Windows system. After installation, the unquoted service paths can be verified using the Windows Management Instrumentation Command-line (WMIC) tool. The service names 'BrAuSvc' and 'BRPA_Agent' will display unquoted file paths that can be exploited to inject malicious executables.