A local privilege escalation vulnerability in the CoolerMaster MasterPlus MPService allows attackers to achieve full system compromise through malicious executable placement.

The application utilizes an unquoted service path for the MPService, which fails to properly encapsulate the file path in quotes. An attacker with local access can place a malicious executable in a parent directory of the path, causing the service to execute the attacker's code with System-level privileges upon startup or reboot.

This vulnerability carries a high CVSS score of 8.4, reflecting the severe impact of unauthorized system-level code execution. A successful exploit allows an attacker to bypass standard local security controls, potentially leading to total system compromise, exfiltration of sensitive data, or the installation of persistent backdoors within the affected environment.

Immediate Action: Update the CoolerMaster MasterPlus software to the latest available version provided by the vendor to resolve the unquoted service path. If an update is not immediately available, administrators should manually quote the service path in the Windows Registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MPService) or ensure that no writable executables are present in the service path parent directories.

Proactive Monitoring: Review system logs for unauthorized file creation events in the root directory or within the CoolerMaster installation path. Monitor service startup logs for unexpected executable calls associated with the MPService.

Compensating Controls: Implement strict file system permissions to prevent non-privileged users from creating files in the directory paths used by system services. Utilize Endpoint Detection and Response (EDR) solutions to flag or block unauthorized processes attempting to run from service-related paths.

Public Exploit Available: Yes — a public exploit exists as documented in ExploitDB (EDB-ID 51159).

Given the availability of a public exploit and the high severity of the privilege escalation, immediate remediation is required. Organizations should prioritize updating the MasterPlus software or applying the manual registry configuration change to ensure the service path is correctly quoted and secured against unauthorized code execution.