A local privilege escalation vulnerability in Atomic Alarm Clock 6.3 permits an attacker to achieve full system compromise by exploiting an unquoted service path.

The application is vulnerable to an unquoted service path flaw (CWE-428) in the AtomicAlarmClock service. An attacker with local access can place a malicious file named Program.exe in the root directory to intercept the service execution and run arbitrary code with SYSTEM privileges.

Successful exploitation of this vulnerability leads to a complete loss of confidentiality, integrity, and availability at the operating system level. By gaining SYSTEM privileges, an attacker can bypass all local security controls, install persistent backdoors, or exfiltrate sensitive data. Given the CVSS score of 7.8, this represents a high-risk security gap for any environment where this software is deployed on shared or multi-user Windows workstations.

Immediate Action: As no official vendor patch is currently available, administrators should immediately disable the affected service or restrict file system write permissions on the root drive to prevent unauthorized placement of the malicious executable.

Proactive Monitoring: Review system logs for the creation of unauthorized executables in the root drive and monitor for unexpected service restarts or modifications to the AtomicAlarmClock service configuration.

Compensating Controls: Use Endpoint Detection and Response (EDR) tools to alert on unauthorized process execution originating from the service path and enforce strict Principle of Least Privilege for local user accounts.

Public Exploit Available: Yes — a published proof-of-concept exploit is available via ExploitDB (EDB-ID: 48352).

The risk posed by this vulnerability is significant due to the escalation of privileges to the highest possible level. Because there is no known official patch, organizations should prioritize removing the software or implementing the recommended compensating controls to prevent local users from achieving system-wide persistence.