An unquoted service path vulnerability in Brother BRAdmin Professional 3.75 allows local attackers to escalate privileges to SYSTEM level.

The application utilizes an unquoted service path for the BRA_Scheduler service, which executes with LocalSystem privileges. A local attacker with write access to the directory containing the service binary can place a malicious executable to hijack the service execution flow.

Successful exploitation allows an unprivileged local user to gain full administrative control over the affected Windows host. This facilitates complete system compromise, including data exfiltration, persistence, and lateral movement within the network. The CVSS score of 7.8 reflects a High severity impact, as it provides a direct path for privilege escalation on managed workstations or servers.

Immediate Action: Update to the latest version of BRAdmin Professional if a patched version is available, or ensure the service path is correctly quoted in the Windows Registry to prevent execution hijacking.

Proactive Monitoring: Review Windows System Event Logs for unexpected service installations or unauthorized modifications to the C:\Program Files (x86)\Brother\ directory.

Compensating Controls: Restrict file system permissions on the installation directory to prevent non-administrative users from writing or modifying files within the Brother application folders.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the Exploit-DB entry (EDB-ID: 49671).

This vulnerability presents a significant risk to internal security by providing a trivial path to full administrative access. Security teams should prioritize identifying all instances of BRAdmin Professional 3.75 and applying vendor-supplied updates or manual path remediation in the registry to neutralize this privilege escalation vector immediately.