A local privilege escalation vulnerability in the Andrea ST Filters Service allows attackers to execute code with system-level permissions.

The application utilizes an unquoted service path in its Windows configuration, which permits a local user to place a malicious executable in a parent directory of the service path. This results in the malicious code executing with LocalSystem privileges when the service starts.

Successful exploitation of this vulnerability grants a local attacker full administrative control over the affected Windows host. This could lead to complete system compromise, the installation of persistent backdoors, and the potential exfiltration of sensitive information, justifying the high CVSS score of 7.8.

Immediate Action: Since no official patch is currently identified, administrators should manually configure the service path to be properly quoted within the Windows Registry or disable the service if it is not business critical.

Proactive Monitoring: Monitor system logs for unauthorized service modifications and inspect the file system for suspicious executables placed within the directory paths of legitimate services.

Compensating Controls: Implement strict file system permissions to prevent low-privileged users from writing files to the directory paths occupied by system services.

Public Exploit Available: Yes, a technical proof-of-concept exists as documented in the Exploit-DB entry 48396.

Given the potential for full system compromise via privilege escalation, organizations using the Andrea ST Filters Service must prioritize securing the service configuration. Administrators should immediately audit the registry for unquoted service paths and apply protective permissions to the installation directories to prevent unauthorized code injection.