An unquoted service path vulnerability in Primera Technology PTPublisher 2.3.4 allows local attackers to achieve arbitrary code execution with system-level privileges.

The PTProtect service utilizes an unquoted executable path, which allows a local attacker with standard user privileges to place a malicious binary in a parent directory, causing the service to execute the attacker controlled file upon restart.

Successful exploitation of this vulnerability grants an attacker full administrative control over the affected host, as the service runs with system privileges. This could lead to a complete compromise of the local machine, unauthorized data access, and potential lateral movement within the corporate network. The CVSS score of 8.4 reflects the high severity of achieving full system access, despite the requirement for local access.

Immediate Action: Upgrade to the latest version of PTPublisher provided by Primera Technology to ensure the service path is properly quoted or corrected.

Proactive Monitoring: Review system logs for unauthorized service installations or unexpected modifications to files within the C:\Program Files (x86)\Primera Technology\ directory.

Compensating Controls: If an immediate update is not feasible, administrators should manually modify the Windows Registry to add quotes to the ImagePath value for the PTProtect service or restrict write permissions on the directory path to prevent unauthorized file placement.

Public Exploit Available: Yes, a proof-of-concept for this vulnerability is documented on Exploit-DB (EDB-ID: 50885).

This vulnerability presents a significant risk due to the potential for privilege escalation to the system level. Organizations running Primera Technology PTPublisher should verify their version and apply the vendor-provided patch immediately to eliminate the vulnerable service configuration.