An unquoted service path vulnerability in Prey 1.9.6 allows local users to achieve privilege escalation by executing arbitrary code with system-level permissions.

The application utilizes an unquoted service path for the CronService, which is a common weakness (CWE-428). A local user with sufficient permissions to write to the system root path can insert a malicious binary that the service will execute with LocalSystem privileges during startup or reboot.

The ability for a local user to escalate privileges to LocalSystem represents a severe security compromise. Once an attacker gains elevated access, they can bypass security controls, install persistent backdoors, or access sensitive data across the entire system. This vulnerability, which warrants a high severity score of 7.8, could facilitate complete system takeover by an otherwise unprivileged local account.

Immediate Action: Since a specific patch is not confirmed in the available data, administrators should restrict file system permissions on the installation directory to prevent unauthorized users from placing malicious executables in the path.

Proactive Monitoring: Security teams should monitor system logs for unusual service startup behavior or the creation of unauthorized files within the application directory.

Compensating Controls: Ensure that local user accounts follow the principle of least privilege, preventing them from modifying critical directories or service configurations.

Public Exploit Available: Yes, a technical write-up and proof-of-concept exist via the Exploit Database (EDB-ID: 48967).

Given the availability of a functional proof-of-concept, the risk of exploitation is significant for environments where untrusted users have local access. Organizations should prioritize restricting permissions on the affected service path and monitor for vendor-provided updates to address the underlying configuration flaw permanently.