BOOTP Turbo Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in BOOTP Turbo version 2.0.1214 due to an unquoted service path. This flaw allows local attackers to execute arbitrary code with elevated privileges. Exploitation involves injecting malicious code into the unquoted executable path, which is then executed when the service starts under the LocalSystem account.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with elevated system privileges.

Reproduction

The vulnerability can be reproduced by exploiting the unquoted service path of the BOOTP Turbo application. After injecting malicious code into the executable path, the service can be restarted, triggering the execution of the injected code with LocalSystem privileges.