A critical unquoted service path vulnerability in IP Watcher version 3.0.0.30 allows local attackers to achieve privilege escalation to LocalSystem.

The application suffers from an unquoted service path vulnerability (CWE-428) in the Windows service configuration. A local attacker can exploit this by placing a malicious executable in the path, which the service will execute with elevated LocalSystem privileges upon startup.

This vulnerability poses a significant risk as it facilitates full local privilege escalation. An attacker who has already gained low-level access to the host can leverage this flaw to gain total control over the operating system, potentially leading to complete data compromise, persistent malware installation, or unauthorized administrative actions. The CVSS score of 7.8 reflects the high severity of this local escalation vector.

Immediate Action: Update to the latest version of IP Watcher if available, or contact the vendor for a security patch addressing the unquoted service path issue.

Proactive Monitoring: Monitor Windows system logs for unexpected service startup behaviors or the creation of new files within the application installation directory.

Compensating Controls: Administrators can manually remediate this by updating the Windows Registry to wrap the service binary path in quotes, ensuring the service controller handles the path string correctly.

Public Exploit Available: Yes, a public exploit exists as documented by the Exploit Database (EDB-ID 48968).

Given the high potential for privilege escalation and the existence of a public exploit, this vulnerability should be prioritized for remediation. Administrators must verify their current version and apply the vendor-recommended update immediately, or manually correct the service path in the registry to prevent unauthorized code execution.