A local privilege escalation vulnerability in Wondershare MobileTrans 3.5.9 allows unprivileged users to execute malicious code with LocalSystem permissions.

The application utilizes an unquoted service path for the ElevationService, which runs as LocalSystem. A local attacker can exploit this by placing a malicious executable in a specific directory on the filesystem, causing the service to execute the attacker's code upon startup.

Successful exploitation allows a local user to gain full control over the affected system by elevating privileges to LocalSystem. Given the CVSS score of 8.4, this poses a high risk to organizational security, as it facilitates complete system compromise, potential data exfiltration, and the installation of persistent backdoors by an attacker who has already gained local access.

Immediate Action: Update Wondershare MobileTrans to the latest version provided by the vendor. If an update is not immediately available, administrators should manually modify the service path configuration to include proper quoting.

Proactive Monitoring: Review system logs for the creation of unauthorized executables in the MobileTrans installation directory or parent folders. Monitor service startup events for unexpected process execution patterns.

Compensating Controls: Restrict write permissions on the installation directory to prevent unauthorized users from placing malicious binaries in the service path. Ensure that non-administrative users do not have permissions to modify service configurations.

Public Exploit Available: Yes, a public proof-of-concept exists via the Exploit Database (EDB-ID 50756).

This vulnerability represents a significant security risk for any environment where Wondershare MobileTrans is deployed, as it grants local users an easy path to full administrative compromise. Organizations should prioritize updating the software or applying the manual configuration fix to ensure that the service path is correctly quoted and secured against unauthorized binary injection.