A local privilege escalation vulnerability in Macro Expert 4.7 could allow attackers to gain LocalSystem privileges by leveraging an improperly configured service path.

This is an unquoted service path vulnerability (CWE-428) involving the service executable path. An authenticated local user can exploit this flaw to execute arbitrary code with LocalSystem privileges during service startup.

The vulnerability poses a severe risk to system integrity and confidentiality, as it enables a local user to escalate privileges to the highest level (LocalSystem). With a CVSS score of 7.8, this flaw facilitates full administrative control over the affected host. Successful exploitation could lead to unauthorized data access, persistence mechanisms, or the complete compromise of the local machine.

Immediate Action: Update Macro Expert to the latest available version provided by the vendor, or manually configure the service path to include quotes if a patch is not immediately applicable.

Proactive Monitoring: Monitor system logs for unexpected service restarts or the creation of unauthorized executable files within the C:\Program Files (x86)\Grasssoft\ directory.

Compensating Controls: Restrict local user permissions to prevent the modification of files or directories in the service path, and implement endpoint detection and response (EDR) solutions to identify suspicious process execution chains.

Public Exploit Available: Yes, a public exploit is available via ExploitDB (EDB-ID: 50431).

Given the availability of a public exploit and the potential for full system compromise, this vulnerability should be treated with high priority. Organizations should audit their installations of Macro Expert immediately and apply the necessary configuration changes or updates to ensure service paths are properly quoted and secured against unauthorized injection.