Splashtop Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in Splashtop version 8.71.12001.0 within the Splashtop Software Updater Service. This vulnerability is an unquoted service path issue that enables local attackers to execute arbitrary code. Exploitation involves injecting malicious executables into the unquoted path located in 'C:\Program Files (x86)\Splashtop\Splashtop Software Updater\'. Such actions could lead to unauthorized privilege escalation.

Impact

Exploitation of this vulnerability could result in unauthorized code execution with elevated privileges.

Reproduction

The vulnerability can be reproduced by exploiting the unquoted service path in the Splashtop Software Updater Service. This can be done by injecting malicious executables into the unquoted path, which is accessible in 'C:\Program Files (x86)\Splashtop\Splashtop Software Updater\'. Once the malicious executable is injected, it can be executed to achieve arbitrary code execution and escalate privileges.