IVT Corporation BlueSoleilCS Unquoted Service Path Vulnerability Allowing Privilege Escalation

A vulnerability exists in BlueSoleilCS version 5.4.277 due to an unquoted service path in the Windows service configuration. This flaw allows local attackers to execute arbitrary code by exploiting the unquoted binary path in 'C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe'. Attackers can inject malicious executables, leading to privilege escalation.

Impact

Exploitation of this vulnerability could result in unauthorized execution of code with elevated privileges.

Reproduction

The vulnerability can be reproduced by querying the service configuration for 'BlueSoleilCS' using the 'sc qc' command. This will reveal the unquoted binary path, which can be exploited to inject malicious executables.