A critical unquoted service path vulnerability in the Alps HID Monitor Service 8.1.0.10 allows local attackers to achieve arbitrary code execution with system-level privileges.

This is an unquoted service path vulnerability (CWE-428) where the service binary path contains spaces and lacks proper quotation marks. A local attacker with low privileges can place a malicious executable in a parent directory of the service path, which the Windows service control manager will execute with SYSTEM privileges upon service restart.

The ability for a local attacker to escalate privileges to the SYSTEM level represents a total compromise of the affected host. This could lead to full data exfiltration, the installation of persistent backdoors, or the complete disruption of business operations on the compromised system. Given the CVSS score of 7.8, this vulnerability poses a significant risk to internal security integrity.

Immediate Action: Update the Alps HID Monitor Service to the latest version provided by the vendor, or if no patch is available, manually modify the service registry key to include proper quotation marks around the executable path (e.g., change the image path to "C:\Program Files\Apoint2K\HidMonitorSvc.exe").

Proactive Monitoring: Review system logs for unexpected service restarts or the creation of unauthorized executable files within the "C:\Program Files" directory structure.

Compensating Controls: Implement strict file system permissions on the "C:\Program Files\Apoint2K" directory to prevent unauthorized users from writing or modifying files in that location.

Public Exploit Available: Yes, a proof-of-concept exists as documented in ExploitDB entry 47605.

This vulnerability presents a clear path to full system compromise for local actors. It is imperative that administrators either apply the vendor-supplied update or manually rectify the service path configuration to prevent privilege escalation. Prioritize this remediation on all workstations and servers where the Alps HID Monitor Service is deployed.