A local privilege escalation vulnerability in SysGauge Server 7.9.18 allows attackers to execute arbitrary code by exploiting an unquoted service path.

The application is susceptible to an unquoted service path vulnerability (CWE-428) located in the binary path configuration for the SysGauge Server service. A local attacker can leverage this misconfiguration to inject a malicious executable into the path, which the system will execute with elevated privileges when the service starts.

The ability for a local user to escalate privileges to the level of the service account, which typically runs as SYSTEM, poses a critical risk to the confidentiality, integrity, and availability of the host. While the CVSS score of 7.8 reflects a high severity, the potential for full system compromise means that successful exploitation could allow an attacker to install persistent backdoors, steal sensitive credentials, or move laterally across the network.

Immediate Action: Update to the latest version of SysGauge Server provided by the vendor, or manually modify the Windows registry to wrap the service binary path in quotes.

Proactive Monitoring: Review system logs for unexpected service restarts or modifications to service binaries within the C:\Program Files\ directory.

Compensating Controls: Ensure that standard users are restricted from writing to the C:\Program Files\ directory to prevent the placement of malicious binaries in the vulnerable path.

Public Exploit Available: Yes, a local exploit is documented in the Exploit Database (EDB-ID: 50009).

The vulnerability presents a clear path for privilege escalation on affected Windows systems. Administrators should prioritize patching or applying the manual configuration fix immediately to prevent local attackers from gaining elevated system access. Given the existence of public exploit code, the risk of internal actors or compromised accounts leveraging this flaw is significant.