A local privilege escalation vulnerability in the Mikogo service allows attackers with low privileges to execute arbitrary code as LocalSystem.

This vulnerability stems from an unquoted service path in the Windows service configuration. By placing a malicious executable in a specific path that the service attempts to load, a low-privileged user can trigger the execution of arbitrary code with LocalSystem privileges.

The ability for a local user to gain LocalSystem privileges represents a total compromise of the affected host. This vulnerability allows for unauthorized access to sensitive data, installation of persistent backdoors, and potential lateral movement within the network. Given the CVSS score of 7.8, this flaw presents a high risk to organizational security, particularly on multi-user systems or environments where local access is provided to untrusted users.

Immediate Action: Update the Mikogo software to a version where the service path is properly quoted or remediated by the vendor. If an update is unavailable, manually modify the Windows registry to add quotes to the ImagePath of the Mikogo-Service.

Proactive Monitoring: Monitor system logs for the execution of unexpected processes or services running from atypical directories within the user profile path. Review system service configurations for any new or unauthorized services that may indicate exploitation.

Compensating Controls: Restrict permissions on the installation directories and subdirectories to prevent unauthorized users from writing files to locations identified in the service path. Ensure that strict access control lists are enforced on all paths involved in service startup.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 47510).

Organizations should prioritize the remediation of this vulnerability to prevent local attackers from achieving full system control. Administrators must ensure the Mikogo-Service path is correctly quoted in the Windows registry to negate the exploitation vector. Failure to address this configuration issue leaves the host susceptible to complete compromise by any user with local access.