10-Strike Bandwidth Monitor Unquoted Service Path Vulnerability Allowing Privilege Escalation

A vulnerability exists in 10-Strike Bandwidth Monitor version 3.9, where multiple services have an unquoted service path. This flaw allows local attackers to escalate privileges by placing a malicious executable in a specific file path. The exploitation of this vulnerability can lead to unauthorized privilege escalation to the SYSTEM level when the service is started.

Impact

Exploitation of this vulnerability allows for local privilege escalation to the SYSTEM account.

Reproduction

The vulnerability can be reproduced by placing a malicious executable in a path that takes advantage of the unquoted service path vulnerability. Once the executable is in place, starting the service will trigger the execution of the malicious payload, leading to privilege escalation.