eMPIA Technology AVACAST Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

A unquoted service path vulnerability has been identified in AVACAST developed by eMPIA Technology, affecting versions through 5.10.10.43. This vulnerability allows privileged local attackers to place a malicious executable file in a specific directory. When the AVACAST service is started, the malicious executable is executed with system privileges, leading to arbitrary code execution.

Impact

Exploitation of this vulnerability allows for arbitrary code execution with system privileges.

Remediation

Users are advised to update to version 5.10.10.45 or later.