A local privilege escalation vulnerability in the Atheros Coex Service Application allows an attacker with low privileges to execute arbitrary code with system-level permissions.

The application utilizes an unquoted service path in its Windows service configuration, specifically within the ZAtheros Bt&Wlan Coex Agent. Because the path contains spaces and is not enclosed in quotes, a local attacker can place a malicious executable in a parent directory to have it run with LocalSystem privileges upon service startup.

Successful exploitation of this vulnerability grants an attacker full control over the affected host, as the service executes with LocalSystem privileges. This can lead to complete system compromise, the installation of persistent backdoors, and the exfiltration of sensitive data, which is reflected by the high CVSS score of 7.8.

Immediate Action: Administrators should immediately verify the service path configuration and apply quotes to the binary path or upgrade to a patched version if provided by the vendor.

Proactive Monitoring: Security teams should monitor for unauthorized file creation within the C:\Program Files (x86)\ directory or any parent directory of the vulnerable service path.

Compensating Controls: Implement strict file system permissions on the directories containing service executables to prevent non-administrative users from writing or modifying files.

Public Exploit Available: Yes, a proof-of-concept exploit is available via Exploit-DB (EDB-ID 49053).

Given the potential for full system compromise, organizations using the Atheros Coex Service Application should prioritize remediating this configuration flaw. Apply proper quoting to the service path or restrict write access to the affected directory immediately to prevent local privilege escalation.