A local privilege escalation vulnerability in IVT Corp BlueSoleilCS 5.4.277 allows attackers with local access to execute arbitrary code with system-level privileges.

The software utilizes an unquoted service path for the BlueSoleilCS Windows service, which resides at C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe. A local attacker can exploit this by placing a malicious executable in a directory that precedes the binary in the search path, causing the service to execute the malicious file with LocalSystem privileges.

Successful exploitation grants an attacker full control over the affected system. Given the CVSS score of 8.4, this vulnerability represents a high risk to organizational security, as it facilitates privilege escalation from a standard user to a system administrator, potentially leading to total system compromise, data theft, or the installation of persistent backdoors.

Immediate Action: Since no specific patch is currently available, administrators should manually modify the service configuration to quote the binary path or move the application to a directory that does not contain spaces.

Proactive Monitoring: Security teams should monitor system logs for unusual process execution patterns or the creation of unexpected executables within the C:\Program Files\IVT Corporation\ directory structure.

Compensating Controls: Implement strict file system permissions on the affected installation directory to prevent non-privileged users from writing or modifying files within the path.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 50761).

This vulnerability presents a significant risk to internal systems, particularly in environments where untrusted users may have local access. Organizations should prioritize remediating this configuration flaw by manually quoting the service path or restricting directory access permissions to prevent unauthorized binary placement. If the software is not business-critical, consider deactivating the service until a formal vendor update is provided.