A local privilege escalation vulnerability in Wondershare MobileGo 8.5.0 allows non-privileged users to gain full administrative control over the affected system.

The application incorrectly assigns file permissions to its installation directory, granting "Everyone" full control over executable files. A local attacker can replace legitimate binaries with malicious code, which will subsequently execute with the privileges of any user, including administrators, who launches the application.

The ability for a local user to escalate privileges to the Administrator level poses a severe risk to organizational security. Successful exploitation allows an attacker to bypass security controls, install persistent backdoors, exfiltrate sensitive data, or disable endpoint protection mechanisms. While the CVSS score of 7.8 reflects a High severity, the potential for total system compromise makes this a significant threat to internal infrastructure.

Immediate Action: Since no official patch is available, administrators should uninstall Wondershare MobileGo from all production environments immediately. If the software is strictly required, ensure it is installed in a restricted directory where standard users do not have write or modify permissions.

Proactive Monitoring: Monitor system logs for the creation of new, unauthorized local user accounts or unexpected modifications to files within the MobileGo installation folder. Review endpoint security alerts for suspicious processes spawning from the MobileGo directory.

Compensating Controls: Apply strict NTFS permissions to the application directory to ensure that only authorized administrative accounts have write access. Ensure that endpoint detection and response (EDR) solutions are configured to block unauthorized binary execution from non-standard paths.

Public Exploit Available: Yes, a published proof-of-concept exploit exists via the Exploit-DB entry 47667.

Given the availability of functional exploit code and the critical nature of privilege escalation, this vulnerability presents a substantial risk to any system where the software remains installed. Organizations must prioritize the removal of this software or the enforcement of strict file-system access controls to prevent unauthorized escalation. Immediate action is required to mitigate the risk of full system compromise.