A local privilege escalation vulnerability in IObit Malware Fighter 4.3.1 allows attackers with low-level access to gain full system control via an unquoted service path flaw.

The software contains unquoted service paths in the IMFservice and LiveUpdateSvc services. A local attacker can exploit this by placing a malicious executable file within the path, which the system will execute with LocalSystem privileges upon service or system restart.

Successful exploitation of this vulnerability allows a local user to escalate their permissions to the highest level of system authority. This compromise poses a severe threat to business operations, as it grants an attacker the ability to install persistent backdoors, access sensitive data, or disable security software entirely. With a CVSS score of 7.8, this vulnerability represents a high risk that requires immediate attention to prevent unauthorized administrative control.

Immediate Action: Upgrade to the latest version of IObit Malware Fighter to ensure the service path configuration is correctly quoted and secured.

Proactive Monitoring: Audit Windows services for unquoted paths and monitor system logs for unexpected service restarts or new executable files created in protected directories.

Compensating Controls: Restrict local user write permissions on the affected installation directories to prevent the placement of malicious binaries.

Public Exploit Available: Yes, a proof of concept exploit is available via ExploitDB (EDB-ID: 40525).

The vulnerability in IObit Malware Fighter presents a significant risk to local system integrity by enabling unauthorized privilege escalation. Security teams should prioritize updating all instances of this software to a patched version immediately. If an update is not immediately feasible, administrators must ensure that standard users do not have write access to the directories where the vulnerable services reside to mitigate the risk of binary planting.