A high-severity local privilege escalation vulnerability in Pysoft Active WebCam 11.5 could allow unauthorized users to execute arbitrary code with system-level privileges.

This is an unquoted search path vulnerability (CWE-428) where the service path for the Active WebCam service is not enclosed in quotes. An authenticated local attacker can exploit this by placing a malicious executable in the directory hierarchy to intercept the service execution and gain full system privileges.

Successful exploitation of this vulnerability results in full system compromise, as the attacker gains LocalSystem privileges. This level of access allows for total control over the affected machine, including data exfiltration, the installation of persistent backdoors, and the ability to bypass all local security controls. The CVSS score of 7.8 reflects the high severity of this local impact, which poses a significant risk to the confidentiality, integrity, and availability of host systems.

Immediate Action: As no official vendor patch is currently confirmed, administrators should manually configure the service path to be enclosed in double quotes or disable the service if it is not required for business operations.

Proactive Monitoring: Security teams should monitor for unauthorized file creation or modifications within the C:\Program Files\ directory structure, specifically looking for unexpected executables.

Compensating Controls: Implement strict file system permissions (Access Control Lists) on the installation directory to prevent non-privileged users from writing or modifying files within the path used by the service.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 50273).

Given the availability of a public proof-of-concept and the high impact of a full system compromise, organizations should prioritize the hardening of the Active WebCam service configuration. If the software cannot be patched or safely reconfigured, it should be removed from production environments until a secure version is verified by the vendor.