A local privilege escalation vulnerability in Wondershare FamiSafe 1.0 allows unauthorized users to execute arbitrary code with system-level permissions.

The application utilizes an unquoted service path for the FSService, which permits a local user with low privileges to place malicious executables in the path hierarchy. Upon service restart, the Windows Service Control Manager will execute the malicious file instead of the intended application, granting the attacker LocalSystem permissions.

Successful exploitation of this vulnerability results in full system compromise. Because the malicious code executes with LocalSystem privileges, an attacker can bypass all local security controls, install persistent backdoors, or access sensitive data across the entire machine. Given the CVSS score of 8.4, this flaw poses a severe risk to the integrity and confidentiality of any host running the affected software.

Immediate Action: There is currently no official patch available from the vendor. Administrators should immediately restrict file system permissions on the C:\Program Files (x86)\Wondershare\ directory to prevent unauthorized users from writing files to the application path.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service restarts or new, unauthorized executable files appearing in the Wondershare installation directory.

Compensating Controls: Implement Endpoint Detection and Response (EDR) solutions to flag and block unauthorized processes attempting to execute from standard application directories.

Public Exploit Available: Yes, a local exploit is available via the Exploit-DB entry 50757.

This vulnerability represents a significant security risk due to the potential for total system takeover. Since a vendor patch is currently unavailable, organizations must prioritize restricting folder permissions as a critical compensating control to prevent local privilege escalation. Users should monitor vendor communications closely for future updates that address the underlying unquoted service path configuration.