TFTP Turbo Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

An unquoted service path vulnerability has been identified in TFTP Turbo version 4.6.1273. This vulnerability allows local attackers to execute arbitrary code with elevated privileges. By exploiting the unquoted path in the service configuration, attackers can inject malicious executables that are executed with LocalSystem permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code with elevated privileges, potentially allowing for significant system compromise.

Reproduction

The vulnerability can be reproduced by injecting a malicious executable into the unquoted service path of the TFTP Turbo application. Once the executable is injected, it will be executed with LocalSystem privileges, allowing for arbitrary code execution on the system.