A local privilege escalation vulnerability in Spy Emergency build 23.0.205 allows authenticated attackers to execute arbitrary code with LocalSystem privileges.

The software suffers from an unquoted service path vulnerability (CWE-428) in the SpyEmrgHealth and SpyEmrgSrv services. A local attacker with low privileges can exploit this by placing a malicious executable within the unquoted path, which the system will execute with LocalSystem privileges upon a service restart or system reboot.

Successful exploitation of this vulnerability results in full system compromise, as the attacker gains the highest level of privilege available on the host. This can lead to unauthorized data access, the installation of persistent backdoors, and the potential for lateral movement across the internal network. The CVSS score of 7.8 reflects the high severity of the impact, although exploitation requires local access to the target machine.

Immediate Action: Upgrade to the latest version of Spy Emergency if a patch is available, or manually secure the service paths by adding quotes to the BINARY_PATH_NAME via the Windows Registry or command line (sc config).

Proactive Monitoring: Audit system services for unquoted paths using tools like PowerUp or manual inspection of the Service Control Manager configuration. Monitor Windows Event Logs for unexpected service restarts or new executable creation in system directories.

Compensating Controls: Implement strict file system permissions on the "C:\Program Files\NETGATE" directory to prevent unprivileged users from writing or modifying files in that location.

Public Exploit Available: Yes, a proof-of-concept exists as documented in Exploit-DB entry 40550.

The risk posed by this vulnerability is significant due to the potential for complete system takeover. Organizations currently running version 23.0.205 should prioritize remediating the service paths immediately. If an update is not available, manual configuration of the service paths to include quotes is a mandatory step to prevent local privilege escalation.