An unquoted service path vulnerability in the Wondershare Driver Install Service allows local attackers to elevate privileges to LocalSystem.

The vulnerability exists due to an unquoted file path in the ElevationService executable. A local attacker can exploit this by placing a malicious binary in a directory within the unquoted path, which the service will execute with elevated LocalSystem privileges upon restart.

Successful exploitation allows a local user to achieve full administrative control over the affected system. Given the CVSS score of 7.8, this represents a significant security risk, as it permits attackers to bypass standard access controls, install persistent backdoors, or exfiltrate sensitive data. This vulnerability could lead to total system compromise and potential lateral movement within the network.

Immediate Action: Since a specific patch is not confirmed, administrators should restrict filesystem permissions on the installation directory to prevent non-privileged users from writing files to the path. If the service is not strictly required, disable or uninstall the Wondershare Driver Install Service until an official vendor fix is verified.

Proactive Monitoring: Monitor Windows Event Logs for service creation events or unexpected modifications to the service binary path. Audit system logs for unusual process execution patterns originating from the Dr.Fone installation directory.

Compensating Controls: Implement Endpoint Detection and Response (EDR) solutions to identify and alert on unauthorized binary execution or privilege escalation attempts. Use Group Policy Objects (GPO) to restrict local write access to the C:\Program Files (x86)\ directory.

Public Exploit Available: Yes — the Exploit-DB entry 49101 provides a detailed proof-of-concept and technical breakdown.

This vulnerability presents a high risk of privilege escalation to any local user on the system. Security teams must prioritize identifying systems running the affected version of Wondershare Dr.Fone and apply strict filesystem access controls immediately to mitigate the risk of malicious binary injection.