A vulnerability in the Private Internet Access service allows local attackers to achieve privilege escalation by exploiting an unquoted service path.

The application is susceptible to an unquoted service path vulnerability (CWE-428) where the service executable path is not properly enclosed in quotes. A local user with low privileges can place a malicious executable in the path to intercept the service startup and execute code with LocalSystem permissions.

The ability for a local user to escalate privileges to the LocalSystem level represents a significant security risk, as it grants the attacker full control over the affected Windows host. With a CVSS score of 8.4, this vulnerability is considered High severity, potentially leading to complete system compromise, the installation of persistent backdoors, or the exfiltration of sensitive data stored on the machine.

Immediate Action: Update the Private Internet Access client to the latest available version provided by the vendor to ensure the service path configuration is corrected.

Proactive Monitoring: Monitor system logs for unauthorized service modifications or the creation of suspicious executable files within the C:\Program Files\ directory structure.

Compensating Controls: Ensure that directory permissions on the C:\Program Files\ path are strictly restricted to prevent non-administrative users from creating or modifying files in these locations.

Public Exploit Available: Yes, a technical write-up and exploit details are available via the Exploit-DB entry (EDB-ID: 50804).

Given the potential for full system compromise, administrators should prioritize updating all instances of the Private Internet Access client. If an immediate update is not feasible, restrict directory permissions on the application installation path to mitigate the risk of a local user injecting a malicious payload.