Epson USB Display Unquoted Service Path Vulnerability Allowing Elevated Privileges

A vulnerability exists in Epson USB Display version 1.6.0.0, specifically within the EMP_UDSA service, which runs with LocalSystem privileges. This vulnerability is due to an unquoted service path, allowing attackers to place malicious executables in intermediate directories. Exploitation of this vulnerability could lead to unauthorized elevated access on the system.

Impact

Exploitation of this vulnerability could result in unauthorized elevated privileges on the affected system.

Reproduction

The vulnerability can be reproduced by placing a malicious executable in a directory along the unquoted service path. The EMP_UDSA service can then be started, which will execute the malicious payload with LocalSystem privileges.