A local privilege escalation vulnerability in Disk Sorter Enterprise 13.6.12 allows attackers to execute arbitrary code with elevated system privileges.

The application suffers from an unquoted service path vulnerability (CWE-428) where the service binary path contains spaces and is not enclosed in quotes. This configuration allows a local attacker to place a malicious executable in a parent directory, which the service will inadvertently execute with LocalSystem privileges upon restart.

Successful exploitation of this vulnerability enables a local user with restricted access to escalate their privileges to LocalSystem. This could lead to a total compromise of the affected host, including unauthorized data access, the installation of persistent backdoors, or the disruption of critical business operations. Given the CVSS score of 7.8, this flaw represents a significant risk to internal security posture and system integrity.

Immediate Action: Update to the latest version of Disk Sorter Enterprise as provided by the vendor to ensure the service path is correctly quoted.

Proactive Monitoring: Review Windows service configurations across the environment to identify any services with unquoted paths that contain spaces.

Compensating Controls: If an immediate update is not feasible, manually modify the service registry key to enclose the binary path in quotes, ensuring that the service is restarted to apply the configuration change.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 50014).

This vulnerability presents a clear path for privilege escalation on Windows systems. Security teams should prioritize patching this version of Disk Sorter Enterprise immediately. If patching cannot be performed, administrative teams must manually secure the service path by applying appropriate registry modifications to prevent malicious binary hijacking.