A local privilege escalation vulnerability in EaseUS Data Recovery 15.1.0.0 allows attackers to gain full system control by exploiting an unquoted service path.

The application utilizes an unquoted service path for the EaseUS UPDATE SERVICE executable. A local attacker can leverage this weakness to place a malicious binary in the file system path, which the service will inadvertently execute with elevated LocalSystem privileges.

Successful exploitation of this vulnerability leads to a complete compromise of the host system. Because the service executes with LocalSystem privileges, an attacker can bypass standard user security controls, install persistent backdoors, or exfiltrate sensitive data. With a CVSS score of 8.4, this represents a high-severity risk that could facilitate lateral movement within the network.

Immediate Action: Since no specific patch is currently identified, administrators should restrict local file system permissions on the affected directory to prevent unauthorized binary placement. If the service is not strictly required, consider disabling the EaseUS UPDATE SERVICE until a vendor-supplied fix is deployed.

Proactive Monitoring: Monitor system logs for the creation of unauthorized executables within the C:\Program Files (x86)\EaseUS\ENS\ directory. Review logs for unexpected service start attempts or suspicious process parent-child relationships involving ensserver.exe.

Compensating Controls: Implement strict Endpoint Detection and Response (EDR) policies to alert on and block unauthorized service modification or the creation of suspicious binaries in protected program directories.

Public Exploit Available: Yes, a public proof-of-concept exploit is available via Exploit-DB (EDB-ID: 50886).

This vulnerability presents a significant risk to system integrity due to the potential for privilege escalation to the LocalSystem level. Organizations utilizing EaseUS Data Recovery 15.1.0.0 must prioritize restricting local file system access and monitor for unauthorized modifications to the installation directory. Please contact the vendor for guidance on available security updates to address this flaw.