A local privilege escalation vulnerability exists in ActiveFax Server 6.92 Build 0316 due to an unquoted service path, which could allow an attacker to execute code as an administrator.

The application is susceptible to a service path hijacking attack because the ActiveFaxServiceNT service binary path is not properly quoted. An attacker with low-level local access can place a malicious executable in the path, which the service will then launch with administrative privileges.

Successful exploitation of this flaw allows a low-privileged user to gain full administrative control over the affected server. This facilitates total system compromise, including data theft, the installation of persistent backdoors, and the potential for lateral movement within the network. Given the CVSS score of 7.8, this represents a high-risk security gap that significantly undermines the integrity and confidentiality of the host environment.

Immediate Action: Administrators should immediately update to the latest available version of ActiveFax Server that contains the fix for this unquoted service path vulnerability.

Proactive Monitoring: Review system service configurations for unquoted paths using tools like PowerShell or Autoruns, and monitor for the creation of suspicious executables within the "C:\Program Files\ActiveFax" directory.

Compensating Controls: If an update cannot be applied immediately, manually modify the Windows Registry to wrap the service binary path in quotes, ensuring that the path is correctly interpreted by the Service Control Manager.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit-DB entry 47503.

This vulnerability presents a clear path for local privilege escalation, transforming a standard user account into an administrative one. Security teams must prioritize remediating this configuration error by applying official patches or manually correcting the service path in the registry to prevent unauthorized administrative access.