A local privilege escalation vulnerability in Honeywell WIN-PAK 4.8 allows authenticated local users to execute arbitrary code with system-level privileges.

The application suffers from an unquoted service path vulnerability (CWE-428) within the ScheduleService. Because the service path contains spaces and lacks quotes, a local attacker can place a malicious executable in the path hierarchy, which the system will then execute with elevated privileges upon service startup.

Successful exploitation of this vulnerability allows a local attacker to gain full control over the affected system. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and potential lateral movement within the network.

Immediate Action: Upgrade to the latest version of WIN-PAK provided by Honeywell that addresses this security flaw. If an immediate update is not feasible, administrators should manually quote the service path in the Windows Registry to prevent the execution of unauthorized binaries.

Proactive Monitoring: Monitor Windows System event logs for unusual service startup activities or the creation of unexpected executable files within the C:\Program Files\ directory structure.

Compensating Controls: Implement strict file system permissions on the installation directory to prevent non-privileged users from creating or modifying files within the application path.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 49691).

This vulnerability presents a significant risk to system integrity due to the potential for privilege escalation. Organizations running WIN-PAK 4.8 must prioritize patching this service path configuration immediately to prevent unauthorized users from gaining administrative control over the host.