Clevo HotKey Clipboard Unquoted Service Path Vulnerability Allowing Privilege Escalation

A privilege escalation vulnerability has been identified in Clevo HotKey Clipboard version 2.1.0.6. The issue arises from an unquoted service path in the HKClipSvc service, which can be exploited by local, non-privileged users to execute arbitrary code with system privileges. The vulnerability allows attackers to inject and run malicious executables by placing them in specific locations within the file system.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution with elevated system privileges.

Reproduction

The vulnerability can be reproduced by placing a malicious executable in a location that takes advantage of the unquoted service path. Once the executable is in place, the HKClipSvc service can be restarted, triggering the execution of the malicious code with system privileges.