A privilege escalation vulnerability in Netgate AMITI Antivirus build 23.0.305 allows local attackers to execute arbitrary code with LocalSystem privileges.

The application utilizes unquoted service paths for the AmitiAvSrv and AmitiAntivirusHealth services, which are configured to run with LocalSystem privileges. A local, low-privileged attacker can exploit this by placing a malicious executable within the path, which the system will inadvertently execute upon service restart or system reboot.

The ability for a local attacker to gain LocalSystem privileges represents a total compromise of the affected host. This could lead to complete data exfiltration, the installation of persistent backdoors, or the disabling of security controls on the endpoint. With a CVSS score of 7.8, this vulnerability is considered High severity, as it provides a direct pathway for lateral movement and full system control.

Immediate Action: Upgrade to the latest version of the software if available, or manually modify the service path configuration to include quotes around the executable path in the Windows Registry.

Proactive Monitoring: Monitor system logs for unauthorized service modifications or the creation of unexpected executable files within the C:\Program Files\NETGATE\ directory structure.

Compensating Controls: Restrict local user write permissions on the installation directory of the antivirus software to prevent the placement of malicious binaries.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 40540).

Given the high impact of local privilege escalation, organizations using this specific version of Netgate AMITI Antivirus must prioritize remediation. If an official patch cannot be applied immediately, administrators should implement strict filesystem permissions on the affected service paths to mitigate the risk of unauthorized binary placement.