A critical unquoted service path vulnerability in WibuKey Runtime 6.51 allows local attackers to execute arbitrary code with elevated privileges.

The vulnerability exists because the service path for WkSvW32.exe is not enclosed in quotes, which allows the Windows service control manager to misinterpret the path. A local attacker with low privileges can place a malicious executable in a directory that precedes the binary in the search order to achieve code execution as LocalSystem.

Successful exploitation allows an attacker who already has local access to the system to escalate their privileges to LocalSystem. This grants full control over the affected machine, potentially leading to total system compromise, exfiltration of sensitive data, or the deployment of persistent threats within the internal network. Given the CVSS score of 7.8, this represents a high-severity risk that requires immediate attention in environments where untrusted local users may exist.

Immediate Action: Update WibuKey Runtime to the latest version provided by Wibu-Systems that addresses this service path configuration.

Proactive Monitoring: Review system service configurations for unquoted paths using tools such as WMIC or PowerShell and monitor for the creation of unauthorized executables in the C:\Program Files (x86) directory.

Compensating Controls: If an update cannot be applied immediately, manually modify the Windows Registry to add quotes to the ImagePath value for the WkSvW32.exe service.

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID: 49999).

This vulnerability presents a significant risk for local privilege escalation. Administrators should prioritize identifying all instances of WibuKey Runtime 6.51 within their environment and apply the necessary vendor patches or manual configuration changes immediately to prevent local attackers from gaining administrative control over the host.