A local privilege escalation vulnerability in Zilab Remote Console Server 3.2.9 allows attackers to achieve full system compromise by injecting malicious binaries into an unquoted service path.

This vulnerability stems from the use of an unquoted service path (CWE-428) in the Windows service configuration for the zrcs service. Because the path contains spaces and lacks quotes, a local attacker with standard privileges can place a malicious executable in a parent directory, which the system will execute with LocalSystem permissions during the service startup process.

The ability for a local attacker to gain LocalSystem privileges represents a total compromise of the affected host. This severity, reflected by the high CVSS score of 7.8, indicates that an attacker who has already established a low-privileged foothold on a machine can bypass all OS security boundaries, leading to complete data exfiltration, persistent malware installation, or total system destruction.

Immediate Action: Administrators should immediately audit the service configuration for the zrcs service and apply proper quoting to the binary path in the Windows Registry or Service Control Manager. If a vendor patch is available, it must be applied immediately to ensure the service path is correctly secured.

Proactive Monitoring: Security teams should monitor system logs for unusual service startup events or the creation of unexpected executable files within the C:\Program Files (x86)\Zilab\ directory.

Compensating Controls: Ensure that standard users are restricted from writing files to the root of the C drive or Program Files directories to prevent the placement of malicious binaries.

Public Exploit Available: Yes, a proof of concept is available via the Exploit-DB entry (EDB-ID 47506).

Given the potential for complete system compromise via local privilege escalation, organizations using Zilab Remote Console Server must prioritize the remediation of this unquoted service path. Immediate configuration hardening is required to prevent local attackers from escalating their privileges to the highest level of system control.