A local privilege escalation vulnerability in 10-Strike Network Inventory Explorer Pro 9.31 allows an attacker with limited access to execute arbitrary code with system-level privileges.

The application utilizes an unquoted service path for the srvInventoryWebServer service, which executes with LocalSystem privileges. An attacker with local access can place a malicious executable in a path segment, causing the system to execute the attacker-controlled binary instead of the intended service.

The ability for a local user to escalate privileges to the LocalSystem account represents a critical risk. A successful exploit grants the attacker full control over the host machine, potentially leading to total system compromise, data exfiltration, or the deployment of further malicious payloads. With a CVSS score of 7.8, this vulnerability is categorized as High, reflecting the significant impact on host confidentiality, integrity, and availability.

Immediate Action: Administrators should update 10-Strike Network Inventory Explorer Pro to the latest version provided by the vendor that addresses this configuration flaw. If an update is not immediately available, manually quote the service path in the Windows Registry to prevent the hijacking of the execution flow.

Proactive Monitoring: Review system logs for unexpected service restarts or new, unauthorized executables appearing in the root or parent directories of the service path. Monitor for unusual process creation events originating from the srvInventoryWebServer service account.

Compensating Controls: Implement strict file system permissions on the installation directory to prevent non-privileged users from creating files or folders in the vulnerable path segments. Ensure that Principle of Least Privilege is enforced for all local user accounts on the affected server.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 50494).

The vulnerability poses a significant risk to host security due to the potential for full system compromise via privilege escalation. It is imperative that organizations prioritize the remediation of this unquoted service path, either through official vendor patches or manual configuration changes, to eliminate the local attack vector and prevent unauthorized administrative access.