An unquoted service path vulnerability in Softros Systems LogonExpert 8.1 allows local attackers to achieve privilege escalation by placing malicious executables in the service path.

This is a local privilege escalation vulnerability (CWE-428) involving an unquoted service path for the LogonExpertSvc service. An attacker with local access can exploit the lack of quotes in the executable path to execute arbitrary code with LocalSystem privileges during service startup.

Successful exploitation of this vulnerability results in full system compromise, as the affected service runs with the highest possible level of local privilege. This allows an attacker to install programs, view, change, or delete data, and create new accounts with full user rights. Given the CVSS score of 7.8, this represents a high risk to the confidentiality, integrity, and availability of any system where the software is installed.

Immediate Action: As no specific patch version is documented in the provided data, administrators should contact Softros Systems support to verify if a patched version is available or if a manual configuration change is recommended.

Proactive Monitoring: Monitor system logs for the creation of unexpected executable files within the C:\Program Files\Softros Systems\ directory structure.

Compensating Controls: Ensure that standard users lack write permissions to the C:\Program Files\ and C:\Program Files (x86)\ directories to prevent the placement of malicious binaries in the vulnerable path.

Public Exploit Available: Yes, a technical write-up and proof-of-concept are available via the Exploit Database (EDB-ID 49586).

Given the high severity and the availability of a public proof-of-concept, users of LogonExpert 8.1 must prioritize securing the service path or upgrading the software if a fix is provided by the vendor. Restricting local user permissions to prevent unauthorized file creation in system directories is a critical interim measure to mitigate the risk of privilege escalation.