Atheros Coex Service Application Unquoted Service Path Vulnerability Allowing Privilege Escalation

A vulnerability exists in the Atheros Coex Service Application version 8.0.0.255, specifically within its Windows service configuration. The issue arises from an unquoted service path, which attackers can exploit by placing malicious executables in the service path. This exploitation can lead to elevated system privileges when the service is started. The vulnerable application is part of the Qualcomm Atheros Bluetooth Suite, commonly found on computers with Atheros Bluetooth adapters.

Impact

Exploitation of this vulnerability allows for unauthorized execution of malicious payloads with elevated system privileges.

Reproduction

The vulnerability can be reproduced by placing a malicious executable in the unquoted service path of the Atheros Coex Service Application. This can be done by first identifying the service name, 'ZAtheros Bt&Wlan Coex Agent', and then placing the executable in the directory 'C:\Program Files (x86)\Bluetooth Suite\' or 'C:\Program Files (x86)\Atheros\', depending on the installation.