A local privilege escalation vulnerability in the VIVE Runtime Service allows authenticated local users to execute arbitrary code with system-level privileges.

The application is susceptible to an unquoted service path vulnerability (CWE-428) because the service binary path contains spaces and lacks protective quotes. This allows a local user with basic privileges to place a malicious executable in a parent directory, which the service will then execute with LocalSystem privileges upon startup.

The ability for a standard local user to escalate privileges to LocalSystem represents a severe security risk. Successful exploitation grants an attacker full control over the affected system, enabling the installation of persistent backdoors, theft of sensitive data, or lateral movement within the network. With a CVSS score of 8.4, this vulnerability is classified as High severity due to the potential for complete system compromise.

Immediate Action: Administrators should verify if the service path is currently quoted. If possible, contact the vendor for an official patch or manually apply quotes to the service binary path via the Windows Registry or command line to prevent the path traversal.

Proactive Monitoring: Review system event logs for unexpected service restarts or new, unauthorized executable files appearing within the installation directories of the VIVE software suite.

Compensating Controls: Implement strict file system permissions on the affected directories to ensure that standard users do not have write access to the paths where the service binary is located.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the Exploit-DB entry 50824.

Given the availability of a public proof-of-concept and the high potential for full system compromise, this vulnerability poses a significant risk to workstations running the VIVE Runtime Service. Organizations should prioritize identifying affected instances and applying the necessary configuration changes to secure the service path immediately.