A local privilege escalation vulnerability in BarcodeOCR 19.3.6 allows attackers to gain elevated system privileges by exploiting an unquoted service path.

The software contains an unquoted service path vulnerability where the service executable path is not enclosed in quotes. A local attacker with low privileges can place a malicious executable in the path hierarchy, which the service will then execute with LocalSystem privileges upon the next system boot or service restart.

Successful exploitation of this vulnerability results in full system compromise, as the attacker gains LocalSystem privileges. This level of access allows for the complete takeover of the affected host, including data exfiltration, installation of persistent backdoors, and lateral movement within the network. With a CVSS score of 7.8, this vulnerability represents a high risk to business operations and data integrity.

Immediate Action: Since no specific patch version is documented, administrators should manually move the service executable to a secure directory or apply quotes to the service path via the Windows Registry to prevent malicious path hijacking.

Proactive Monitoring: Review system service configurations for unquoted paths using tools like WMIC or PowerShell and monitor for unauthorized executable files appearing in the Program Files directory structure.

Compensating Controls: Restrict local write permissions to the C:\Program Files (x86)\ directory to prevent non-privileged users from placing malicious binaries in the vulnerable path.

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID: 48740).

Given the ease of exploitation and the resulting impact of full system compromise, it is imperative that organizations using BarcodeOCR 19.3.6 address this configuration flaw immediately. Administrators should prioritize securing the service path or restricting directory permissions to mitigate the risk of local privilege escalation while awaiting further guidance from the vendor.