A local privilege escalation vulnerability in the KiteService Windows service allows attackers to execute arbitrary code with system-level permissions.

This vulnerability is a CWE-428 Unquoted Search Path flaw located in the KiteService executable path, which lacks proper quotation marks. A local, authenticated attacker can exploit this by placing a malicious binary in a directory within the unquoted path, which the system will then execute with LocalSystem privileges.

Successful exploitation of this vulnerability allows a local attacker to gain full control over the affected Windows host. Because the service runs with LocalSystem privileges, this results in a complete compromise of the system, potentially leading to unauthorized data access, the installation of persistent backdoors, or the lateral movement of threats within the internal network. Given the CVSS score of 7.8, this represents a high-severity risk that requires immediate remediation in multi-user or shared environments.

Immediate Action: Upgrade to the latest available version of the Kite software if a patch is provided by the vendor, or manually modify the service path registry keys to include quotes around the executable path.

Proactive Monitoring: Monitor system logs for unauthorized file creation in directories such as C:\Program Files\ and review service configuration changes using tools like Sysmon or Group Policy auditing.

Compensating Controls: Restrict write permissions on the C:\ drive and specifically within the Program Files directory to prevent non-privileged users from placing malicious executables in the vulnerable path.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the Exploit Database (EDB-ID: 49205).

Organizations should prioritize the remediation of this vulnerability by either applying vendor-supplied updates or implementing the necessary registry hardening. Given the existence of a public proof-of-concept, the risk of local privilege escalation is significant, and administrators must ensure that standard user accounts are restricted from modifying system directories to prevent exploitation.