An unquoted service path vulnerability in VX Search 13.5.28 could allow a local attacker with low privileges to achieve full system-level privilege escalation.

This is a CWE-428 vulnerability where the software service path is not properly quoted. A local attacker can exploit this by placing a malicious executable in the path to gain elevated privileges.

The ability for a low-privileged user to escalate to full system privileges poses a critical risk to host security. With a CVSS score of 7.8, this flaw could allow an attacker to bypass all OS-level access controls, leading to total system compromise, data theft, or the installation of persistent malware.

Immediate Action: Audit systems for the affected VX Search version and apply any available security patches; if unavailable, manually quote the service path in the Windows Registry or disable the service.

Proactive Monitoring: Review system logs for unauthorized service installations or unexpected changes to service executables.

Compensating Controls: Implement strict file system permissions to prevent low-privileged users from writing to the directories identified in the service path.

Public Exploit Available: Yes — an entry exists on ExploitDB (50026).

This vulnerability represents a significant security risk for Windows environments hosting VX Search. Immediate remediation via patching or manual path correction is required to prevent local attackers from gaining full control over the host operating system.