A local privilege escalation vulnerability in Honeywell WIN-PACK PRO 4.8 allows authenticated local users to execute arbitrary code with system-level privileges.

The application utilizes an unquoted service path for the GuardTourService, which enables a local user to inject a malicious executable into the path, leading to code execution upon service restart with elevated LocalSystem privileges.

Successful exploitation of this flaw allows a local user to gain full administrative control over the underlying Windows host. This effectively bypasses standard security boundaries, potentially leading to total system compromise, data theft, and the installation of persistent malicious software. Given the CVSS score of 7.8, this represents a high-severity risk for any environment where untrusted local users have access to the server.

Immediate Action: Contact Honeywell support to obtain the latest security patches or configuration guidance to resolve the unquoted service path issue, as no public patch version is currently listed.

Proactive Monitoring: Monitor Windows System Event Logs for unexpected service restarts or new file creation events within the C:\Program Files (x86)\ directory.

Compensating Controls: Ensure that local users are restricted from writing to the C:\Program Files (x86)\ directory and that the service permissions are hardened to prevent modification by unauthorized users.

Public Exploit Available: Yes, a technical write-up and proof-of-concept are available via ExploitDB (EDB-ID 49690).

The presence of a published proof-of-concept significantly elevates the risk of this vulnerability. Administrators must prioritize securing the service path or restricting directory access immediately to prevent local attackers from escalating their privileges to the system level. If an official patch is not yet applied, strictly enforce the principle of least privilege for all local user accounts on the affected host.