A local privilege escalation vulnerability in Spy Emergency 25.0.650 allows low-privileged attackers to execute arbitrary code with system-level permissions.

The software contains an unquoted service path vulnerability (CWE-428) in the SpyEmergencyHealth.exe and SpyEmergencySrv.exe services. This flaw allows a local, authenticated attacker to place a malicious executable in a parent directory of the service path, which the system will then execute with LocalSystem privileges during service startup or restart.

The vulnerability presents a high risk to organizational security, as it allows for full system compromise from a standard user account. With a CVSS score of 7.8, this flaw facilitates lateral movement, data exfiltration, or the installation of persistent malware, effectively bypassing traditional user-level security boundaries.

Immediate Action: Since no specific patch is documented, administrators should verify if a newer version of Spy Emergency is available from the vendor and apply it immediately. If no update is available, consider restricting permissions on the installation directories to prevent unauthorized file placement.

Proactive Monitoring: Review Windows System and Security event logs for unexpected service restarts or file creation events within the C:\Program Files\NETGATE directory. Monitor for any processes spawning from the Spy Emergency service paths that do not match the expected vendor-signed binaries.

Compensating Controls: Implement strict file system permissions (Access Control Lists) on the installation paths to ensure only authorized administrators can write to the directory. Utilize Endpoint Detection and Response (EDR) solutions to flag or block unauthorized executable files being created in service-related paths.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the Exploit Database (EDB-ID 49997).

Given the availability of a functional proof-of-concept and the high impact of local privilege escalation, this vulnerability must be addressed with urgency. Administrators should prioritize updating the software or applying strict folder-level permissions to mitigate the risk of malicious service hijacking.