A local privilege escalation vulnerability in Wondershare Dr.Fone version 11.4.9 could allow a local user to execute malicious code with elevated system privileges.

This is an unquoted service path vulnerability (CWE-428) in the DFWSIDService, which runs with LocalSystem privileges. An attacker with local access can place a malicious executable in the path of the service, causing the system to execute the attacker's file instead of the legitimate service binary upon startup or reboot.

Successful exploitation of this vulnerability allows a local attacker to gain full control over the affected system by escalating privileges to LocalSystem. Given the CVSS score of 8.4, this represents a high-severity risk that could lead to complete compromise of the host, including sensitive data exfiltration or the installation of persistent backdoors.

Immediate Action: Since no specific patch version is documented, identify and manually quote the path for the DFWSIDService in the Windows Registry or disable the service if it is not required for business operations.

Proactive Monitoring: Monitor system logs for unauthorized service installations or modifications to service configuration paths within the registry.

Compensating Controls: Implement strict file system permissions on the C:\Program Files (x86)\ directory to prevent unprivileged users from creating or modifying files in application folders.

Public Exploit Available: Yes, a technical proof of concept is available via Exploit-DB (EDB-ID 50755).

This vulnerability presents a significant risk to local system integrity by allowing privilege escalation to the highest system level. Administrators should prioritize securing the service path configuration immediately to prevent local users from hijacking the service execution flow. If the software is not critical, uninstalling the affected version is the most effective way to eliminate this risk until the vendor provides a verified security update.