A critical unquoted service path vulnerability in Brother BRAgent 1.38 allows local attackers to achieve full system compromise through privilege escalation.

The software utilizes an unquoted service path for the WBA_Agent_Client service, which executes with LocalSystem privileges. A local, authenticated attacker can leverage this misconfiguration to place a malicious executable in the path, resulting in arbitrary code execution with the highest level of system authority.

Successful exploitation of this vulnerability grants an attacker full control over the affected system, as the service runs with LocalSystem privileges. This can lead to complete data compromise, installation of persistent backdoors, and lateral movement within the network. With a CVSS score of 7.8, the vulnerability represents a high-severity risk to system integrity and confidentiality.

Immediate Action: Review your environment for instances of Brother BRAgent 1.38 and update the software to the latest patched version provided by the vendor. If an update is not immediately available, manually quote the service path in the Windows Registry to prevent unauthorized binary execution.

Proactive Monitoring: Monitor Windows Event Logs for unusual service start events or the creation of unexpected files within the C:\Program Files (x86)\Brother\ directory.

Compensating Controls: Implement strict file system permissions on the C:\ drive to prevent standard users from writing files to protected directories, effectively neutralizing the ability to plant malicious executables.

Public Exploit Available: Yes, a public exploit exists as documented in ExploitDB (EDB-ID: 50010).

The presence of a public proof-of-concept exploit combined with the high-privilege nature of the affected service makes this a priority for remediation. IT administrators should verify their software inventory for Brother BRAgent and apply the necessary configuration changes or patches immediately to prevent potential local privilege escalation attacks.