A local privilege escalation vulnerability exists in Wondershare Dr.Fone 12.0.18 that allows authenticated local users to execute arbitrary code with LocalSystem permissions.

The software utilizes an unquoted service path for the Wondershare InstallAssist service. An attacker with local access can place a malicious executable in the path hierarchy, which the system will then execute with elevated LocalSystem privileges upon service startup.

Successful exploitation of this vulnerability allows a local attacker to gain full administrative control over the affected system. Given the CVSS score of 8.4, this represents a significant risk to system integrity and confidentiality, as it facilitates complete compromise of the host environment.

Immediate Action: As no official patch is currently identified, administrators should restrict local access to the affected machine and consider disabling or removing the Wondershare InstallAssist service if it is not strictly required for business operations.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service startup events or the creation of new, unauthorized executable files within the C:\ProgramData\Wondershare directory.

Compensating Controls: Implement strict file system permissions on the C:\ProgramData directory to prevent unprivileged users from writing or modifying files within the Wondershare subdirectories.

Public Exploit Available: Yes, a published proof-of-concept exists per the Exploit-DB entry 50813.

Due to the severity of this privilege escalation flaw, organizations should treat this as a high-priority remediation task. If the software cannot be updated or removed, restricting local user permissions to prevent unauthorized file placement in the application directory is essential to mitigate the risk of full system compromise.