A local unquoted service path vulnerability in iFunbox 4.2 allows attackers to escalate privileges to LocalSystem, posing a critical security risk to the host operating system.

This is an unquoted service path vulnerability (CWE-428) where the Apple Mobile Device Service executable path is not enclosed in quotes. A local attacker with low privileges can exploit this by placing a malicious executable in the path, causing the service to run the malicious file with LocalSystem privileges upon service restart.

The ability for a local attacker to execute arbitrary code with LocalSystem privileges represents a total compromise of the affected host. This could lead to unauthorized data access, the installation of persistent backdoors, and total system control. With a CVSS score of 7.8, this vulnerability is considered high severity due to the high impact on confidentiality, integrity, and availability.

Immediate Action: Upgrade to the latest version of iFunbox or, if a patch is unavailable, manually modify the service path in the Windows Registry to include quotes around the executable path.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service restarts or the creation of new, unauthorized executables within the "C:\Program Files (x86)\i-Funbox DevTeam" directory.

Compensating Controls: Use Endpoint Detection and Response (EDR) tools to alert on file creation events in protected directories and restrict write permissions for standard users in the installation folder of the software.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the ExploitDB entry 50040.

Given the potential for privilege escalation to the highest level of system authority, it is imperative that organizations using iFunbox 4.2 verify their installation path configuration immediately. If the service path is found to be unquoted, administrators should apply the necessary registry changes to enclose the path in quotes or remove the vulnerable software component if it is not essential for business operations.