A local privilege escalation vulnerability in Gearboxcomputers Program Access Controller 1.2.0.0 allows attackers to execute arbitrary code with LocalSystem permissions.

The software contains an unquoted service path vulnerability (CWE-428) within the PACService.exe binary. A local attacker can exploit this by placing a malicious executable in the path, which the system will execute with LocalSystem privileges during the next service startup or system reboot.

Successful exploitation of this flaw grants an attacker full administrative control over the affected system. This level of access allows for total data compromise, the installation of persistent backdoors, and the potential for lateral movement across the internal network. Given the CVSS score of 7.8, this constitutes a high-severity risk that demands prompt remediation to prevent complete system compromise.

Immediate Action: Update to the latest version of Program Access Controller provided by Gearboxcomputers that resolves the unquoted service path issue. If an update is unavailable, administrators should manually quote the service path in the Windows Registry or disable the vulnerable service.

Proactive Monitoring: Review system event logs for unexpected service start failures or the creation of new, unauthorized executables within the Program Files directory structure.

Compensating Controls: Implement strict file system permissions on the C:\Program Files and C:\Program Files (x86) directories to prevent unprivileged users from creating or modifying files in these locations.

Public Exploit Available: Yes, a public exploit exists via an ExploitDB entry (EDB-ID 48966).

This vulnerability represents a significant risk to system integrity due to the ease of achieving local privilege escalation. Security teams should prioritize identifying all instances of Program Access Controller 1.2.0.0 in their environment and applying the necessary vendor patches or configuration changes immediately to prevent unauthorized administrative access.