A vulnerability in the BOOTP Turbo Windows service allows local attackers to achieve privilege escalation by exploiting an unquoted service path.

The application utilizes an unquoted service path for the Windows service binary, which allows a local attacker with standard user privileges to place a malicious executable in a parent directory and have it executed with LocalSystem privileges during a system reboot.

Successful exploitation of this vulnerability leads to full system compromise, as the malicious code executes with the highest possible level of privilege on the Windows operating system. Given the CVSS score of 7.8, this represents a high-severity risk that could be leveraged for persistence, data theft, or further lateral movement within the network. Organizations relying on this software for network configuration services are particularly exposed to local privilege escalation attacks.

Immediate Action: Since a specific patch is not confirmed, administrators should manually remediate the service configuration by quoting the service path in the Windows Registry (specifically under HKLM\SYSTEM\CurrentControlSet\Services) or by migrating to a supported version if available.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service execution failures or the creation of new, unrecognized executables within the "C:\Program Files" directory structure.

Compensating Controls: Restrict write permissions on the "C:\Program Files" and "C:\Program Files (x86)" directories to prevent unauthorized users from placing malicious binaries in the path of vulnerable services.

Public Exploit Available: Yes, a proof-of-concept exploit is available via Exploit-DB (EDB-ID: 49851).

This vulnerability presents a significant risk to host integrity due to the potential for privilege escalation. Administrators must prioritize the manual hardening of the service configuration to prevent local attackers from abusing the unquoted path. Given the existence of a public proof-of-concept, remediating this configuration error is a necessary step to maintain a secure environment.