An unquoted service path vulnerability in the OSAS Traverse Extension 11 service allows a local attacker to execute arbitrary code with LocalSystem privileges.

The TravExtensionHostSvc service utilizes an unquoted executable path, which is a classic flaw where the Windows Service Control Manager may interpret path segments as independent executable files. Because the service runs with LocalSystem privileges, an attacker with local access can place a malicious binary in a higher-level directory to achieve full system compromise.

The exploitation of this vulnerability results in full administrative control over the underlying host. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and the potential for lateral movement within the production environment.

Immediate Action: Since no official patch is currently identified, administrators should manually modify the service path in the Windows Registry to wrap the binary location in double quotes (e.g., "C:\Program Files\Open Systems, Inc\TRAVERSE\TRAVERSE.Host.CustomExtensions.exe").

Proactive Monitoring: Audit Windows service configurations for unquoted paths using tools such as WMIC or PowerShell, and monitor system logs for unusual process execution patterns originating from the service directory.

Compensating Controls: Restrict local user permissions on the server to prevent unauthorized file creation in directories contained within the service path, effectively neutralizing the attack vector.

Public Exploit Available: Yes, a functional local exploit is documented on ExploitDB (EDB-ID: 49698).

While this vulnerability requires local access, the resulting impact is total system compromise. Organizations running OSAS Traverse Extension 11 must prioritize the manual remediation of the service path configuration immediately, as the existence of a public exploit significantly lowers the barrier to entry for potential attackers.