A local privilege escalation vulnerability in NETGATE Registry Cleaner version 16.0.205 allows attackers to execute arbitrary code with LocalSystem privileges.

The application suffers from an unquoted service path vulnerability (CWE-428) in the NGRegClnSrv service. A local attacker with low privileges can place a malicious executable in the path and trigger a service restart to gain full system control.

Successful exploitation allows a local user to escalate their permissions to the LocalSystem account, which is the highest level of privilege on a Windows operating system. This compromise can lead to complete system takeover, unauthorized access to sensitive data, and the potential for persistent malware installation. Given the CVSS score of 7.8, this represents a high risk to the confidentiality, integrity, and availability of affected host systems.

Immediate Action: Upgrade to the latest version of the software where this service path configuration has been corrected. If an update is unavailable, manually quote the service path in the Windows Registry under the ImagePath key for the NGRegClnSrv service.

Proactive Monitoring: Audit service configurations for unquoted paths using tools like PowerShell or Autoruns to identify similar weaknesses across the environment. Monitor system logs for unauthorized service modifications or unexpected file creation in the C:\Program Files directory.

Compensating Controls: Implement strict file system permissions to prevent low-privileged users from writing files to the directory path where the service resides.

Public Exploit Available: Yes, a functional local exploit is documented on ExploitDB (EDB-ID: 40539).

The presence of a public exploit targeting this flaw necessitates immediate attention to prevent local privilege escalation. Administrators should verify the current version of NETGATE Registry Cleaner in use and apply the necessary patches or configuration changes to ensure the service path is properly quoted. Failure to remediate this vulnerability leaves local systems susceptible to full compromise by any user with basic access.