A local privilege escalation vulnerability in Gearboxcomputers WifiHotSpot allows attackers to execute arbitrary code with LocalSystem permissions by exploiting an unquoted service path.

The application utilizes an unquoted service path for the WifiHotSpotService.exe binary. A local attacker can place a malicious executable in a directory within the path, which the service will then execute with elevated LocalSystem privileges upon system startup or reboot.

Successful exploitation of this vulnerability grants an attacker full administrative control over the affected host. This presents a critical risk of complete system compromise, including the potential for data exfiltration, installation of persistent backdoors, and lateral movement within the network. While the CVSS score of 7.8 reflects a high severity, the requirement for local access prevents this from being ranked as critical.

Immediate Action: As no official patch is currently identified, administrators should manually move or rename the affected service executable to a path that does not contain spaces, or apply appropriate quotes to the service image path in the Windows Registry (HKLM\SYSTEM\CurrentControlSet\Services).

Proactive Monitoring: Monitor system logs for unauthorized service installations or modifications, and review the integrity of directories within the C:\Program Files (x86)\ path for suspicious executable files.

Compensating Controls: Implement strict file system permissions on the installation directory to prevent non-privileged users from writing or modifying files within the application folder.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit Database (EDB-ID: 49845).

Given the potential for full system compromise via privilege escalation, it is imperative that organizations running this software identify and remediate the unquoted service path immediately. Administrators should prioritize modifying the service configuration to include proper quoting or relocating the binary to a secure, non-space-containing path to mitigate the risk of malicious code execution during system startup.