Epson Unquoted Service Path Vulnerability in SENADB Service Allowing Local Privilege Escalation

A vulnerability exists in Epson software version 1.124 within the SENADB service, related to an unquoted service path. This flaw enables local attackers to execute code with elevated system privileges. Exploitation involves injecting malicious executables into the unquoted path located in 'C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\'. The injected code would run with LocalSystem permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution with elevated privileges on the affected system.

Reproduction

The vulnerability can be reproduced by exploiting the unquoted service path of the SENADB service. This can be done by placing a malicious executable in the service's path, which is 'C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmdb.exe'. Once the executable is in place, the service can be started, and the malicious code will execute with LocalSystem privileges.