A local privilege escalation vulnerability in Brother BRPrint Auditor 3.0.7 allows attackers to execute arbitrary code with system-level privileges due to improper handling of service paths.

The software contains an unquoted service path vulnerability (CWE-428) in the BrAuSvc and BRPA_Agent Windows services. A local attacker with low-level privileges can exploit this by placing a malicious executable in the path, which the service will then execute with LocalSystem permissions.

Successful exploitation allows a local user to escalate their privileges to LocalSystem, effectively granting them full control over the affected Windows host. This could lead to complete system compromise, unauthorized access to sensitive data, and the potential for lateral movement within the network. Given the CVSS score of 7.8, this vulnerability represents a significant risk to the integrity and confidentiality of the host environment.

Immediate Action: Update to the latest version of Brother BRPrint Auditor provided by the vendor. If an update is not immediately feasible, manually modify the Windows Registry to quote the service path for the affected services.

Proactive Monitoring: Review Windows System Event logs for unexpected service starts or the creation of new, unrecognized executable files within the "Program Files (x86)" directory structure.

Compensating Controls: Implement strict file system permissions on the "Program Files" and "Program Files (x86)" directories to prevent unauthorized local users from creating or modifying files in these locations.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 50005).

The vulnerability poses a high risk to internal systems, especially in environments where non-privileged users have local access to workstations or servers running the Auditor software. Administrators should prioritize patching or applying the registry-based configuration fix immediately to prevent local privilege escalation.