A vulnerability in FSPro Labs Event Log Explorer 4.9.3 allows local attackers to gain elevated system privileges by exploiting an unquoted service path.

The application utilizes an unquoted service path for the ElodeaEventCollectorService, which permits a local user to place a malicious executable in a directory that the service incorrectly interprets as a path component. This allows the attacker to execute arbitrary code under the context of the LocalSystem account during service startup.

Successful exploitation of this flaw grants an attacker full control over the affected system by elevating local access to administrative privileges. This poses a severe risk to data confidentiality, integrity, and availability, as the attacker can install malware, access sensitive event logs, or pivot further into the internal network. The CVSS score of 7.8 reflects the high severity of this local privilege escalation vector.

Immediate Action: Update to the latest version of Event Log Explorer provided by FSPro Labs, which addresses the unquoted service path issue. If an update is not immediately available, administrators should manually modify the service path registry key to include quotes around the executable path.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service startup failures or the creation of new executable files in the Program Files directory. Review system logs for unauthorized changes to service configurations or registry keys related to service paths.

Compensating Controls: Implement strict file system permissions on the installation directory to prevent unauthorized users from writing files to the application path. Ensure that the principle of least privilege is enforced for all local user accounts to limit the impact of potential local exploitation.

Public Exploit Available: Yes, a published proof-of-concept exists as documented on Exploit-DB.

This vulnerability represents a significant security risk for any host running the affected version of the Event Log Explorer. Administrators must prioritize updating the software or manually correcting the service path configuration to prevent local attackers from achieving full system compromise.