A local privilege escalation vulnerability in CodeMeter 6.60 allows attackers to achieve system-level code execution by exploiting an unquoted service path.

The application utilizes an unquoted service path for the CodeMeter Runtime Server, which fails to encapsulate the binary path in quotes. This allows a local, low-privileged user to place a malicious executable in a parent directory of the path, which the system will then execute with LocalSystem privileges during service startup.

Successful exploitation grants an attacker full control over the host operating system, leading to complete compromise of confidentiality, integrity, and availability. Given the CVSS score of 7.8, this vulnerability poses a significant risk to internal infrastructure, as an attacker with limited local access can pivot to administrative control, potentially facilitating lateral movement or data exfiltration.

Immediate Action: Upgrade the CodeMeter Runtime software to a version beyond 6.60 where the service path is properly quoted and secured.

Proactive Monitoring: Monitor system logs for the execution of unexpected binaries within the C:\Program Files (x86)\CodeMeter directory and audit services for unquoted paths using administrative tools.

Compensating Controls: Restrict write permissions on the C:\ drive and specifically on the Program Files (x86) directory to prevent unauthorized users from placing malicious executables in the vulnerable path.

Public Exploit Available: Yes, a local exploit is available via the Exploit Database (EDB-ID 48735).

This vulnerability represents a high-risk vector for privilege escalation within any environment utilizing the affected CodeMeter version. Administrators must prioritize updating the software to a patched release immediately to eliminate the unquoted service path, thereby preventing local attackers from escalating their privileges to the system level.