A local privilege escalation vulnerability in Honeywell WIN-PAK PRO 4.8 allows authenticated attackers to execute arbitrary code with LocalSystem permissions.

This vulnerability involves an unquoted service path in the WPCommandFileService, specifically located at C:\Program Files \WINPAKPRO\WPCommandFileService Service.exe. By placing a malicious executable in a specific directory along this path, a local user can trigger the execution of their code with LocalSystem privileges during the service startup process.

Successful exploitation of this flaw leads to a complete compromise of the host system, as the attacker gains LocalSystem privileges. This level of access allows an attacker to bypass standard security controls, install persistent backdoors, or access sensitive data managed by the software. Given the CVSS score of 7.8, this represents a high-risk security gap that could lead to significant operational disruption if the underlying host is compromised.

Immediate Action: Contact Honeywell support to obtain the official security update or configuration guidance to secure the service path. Ensure that the service configuration is updated to use a quoted path or move the executable to a secure directory.

Proactive Monitoring: Audit Windows services for unquoted service paths and monitor system logs for unusual process creation events originating from the WIN-PAK installation directory.

Compensating Controls: Restrict write permissions on the C:\Program Files (x86) directory to prevent unauthorized users from placing malicious executables in potential search paths.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 49692).

This vulnerability presents a significant risk to the integrity of systems running Honeywell WIN-PAK PRO 4.8. Administrators should prioritize the remediation of this unquoted service path through vendor-provided patches or manual configuration changes. Given the availability of a public proof-of-concept, the urgency for remediation is elevated, and organizations should ensure that local user permissions are strictly managed to prevent the placement of malicious binaries.