An unquoted service path vulnerability in DiskPulse Enterprise 13.6.14 allows local, low-privileged users to achieve arbitrary code execution with system-level privileges.

The software contains an unquoted service path vulnerability in its Windows service configuration, specifically within the service executables for Disk Pulse Enterprise and Disk Pulse Server. A local, authenticated attacker can leverage this flaw to place a malicious executable in a directory that the service incorrectly parses, resulting in the execution of code as LocalSystem.

Successful exploitation of this vulnerability grants an attacker full control over the affected system. Because the service runs with LocalSystem privileges, a local attacker can bypass standard user restrictions, install persistent backdoors, or exfiltrate sensitive data. With a CVSS score of 7.8, this represents a significant risk to the integrity and confidentiality of the host machine.

Immediate Action: Organizations currently running DiskPulse Enterprise 13.6.14 should contact the vendor to obtain a patched version or specific guidance on securing the service path configuration. If an official patch is unavailable, manually quoting the service path in the Windows Registry is a necessary technical workaround.

Proactive Monitoring: Security teams should monitor for unauthorized file creation or modifications in the C:\Program Files\ directory, specifically looking for unexpected executables within the Disk Pulse installation paths.

Compensating Controls: Ensure that standard users are restricted from writing to the C:\Program Files\ directory to prevent the placement of malicious binaries.

Public Exploit Available: Yes — a technical write-up and proof-of-concept are available via Exploit-DB (EDB-ID 50012).

The severity of this flaw cannot be understated for internal environments, as it provides a direct path for privilege escalation from any local user account. Administrators must prioritize the remediation of this service configuration to prevent attackers from gaining full system control. If immediate patching is not feasible, restrict local user permissions to prevent the placement of unauthorized binaries in the application directory.