A vulnerability in the Realtek Wireless LAN Utility allows local attackers to escalate privileges to the system level by exploiting an unquoted service path.

The application utilizes an unquoted service path for the Realtek11nSU service, which runs with LocalSystem privileges. A local attacker can exploit this by placing a malicious executable in a directory within the path, causing the service to execute the attacker's code upon startup or reboot.

The ability for a local user to execute code with elevated system privileges represents a significant security failure. Successful exploitation grants the attacker full control over the affected machine, potentially leading to unauthorized data access, the installation of persistent backdoors, or lateral movement within the network. This risk is underscored by the CVSS score of 7.8, which reflects the high severity of potential system-level compromise.

Immediate Action: Since no official patch is confirmed, administrators should restrict folder permissions on the affected system paths to prevent unauthorized writes, or uninstall the utility if it is not business-critical.

Proactive Monitoring: Monitor system logs for the execution of unexpected binaries from the C:\Program Files (x86)\Realtek\Wireless LAN Utility\ directory and audit service configurations for unquoted paths.

Compensating Controls: Use Group Policy Objects (GPO) to enforce strict file system permissions on the installation directory, ensuring that only administrators have write access to the path.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 49646.

Given the potential for full system compromise, organizations should treat this vulnerability with high priority. If the software cannot be uninstalled, immediate steps must be taken to secure the directory permissions to prevent local attackers from placing malicious payloads. Ensure that security teams monitor for any unauthorized changes to the service configuration or the creation of suspicious executables within the application directory.