A local privilege escalation vulnerability exists in Luidia eBeam Interactive Suite 3.6 due to an unquoted service path, potentially allowing attackers to execute malicious code as LocalSystem.

The vulnerability involves an unquoted service path in the eBeam Stylus Driver service. A local attacker can exploit this by placing a malicious executable in a specific directory along the path, which the system will then execute with elevated LocalSystem permissions upon service startup.

Successful exploitation of this vulnerability allows a local user to gain full administrative control over the affected system. This poses a significant security risk, as it facilitates unauthorized access to sensitive data, potential installation of persistent backdoors, and total compromise of the host machine's integrity. Given the CVSS score of 7.8, this is considered a high-severity issue that requires prompt attention to prevent lateral movement within the network.

Immediate Action: Since no official patch is currently available, administrators should manually modify the service path registry key for the eBeam Stylus Driver to include quotes around the executable path. Alternatively, if the software is not mission-critical, uninstall the application until the vendor provides a secure update.

Proactive Monitoring: Monitor system logs for unexpected service restarts or the creation of unauthorized executables within the C:\Program Files (x86)\Luidia\ directory. Review logs for any unusual activity associated with the eBeam Stylus Driver service.

Compensating Controls: Implement strict file system permissions to prevent low-privileged users from writing files to the Luidia installation directory. Ensure that Endpoint Detection and Response (EDR) solutions are configured to alert on unauthorized attempts to modify system services.

Public Exploit Available: Yes, a local exploit is available via Exploit-DB (EDB-ID 49648).

Due to the risk of local privilege escalation and the availability of public exploit code, this vulnerability should be addressed immediately. Administrators should prioritize securing the service path configuration or removing the affected software to mitigate the risk of full system compromise by local attackers.