A local privilege escalation vulnerability exists in Connectify Hotspot 2018 due to an unquoted service path that could allow an attacker to execute arbitrary code with SYSTEM privileges.

This is an unquoted search path vulnerability (CWE-428) in the ConnectifyService executable. Because the service path contains spaces and lacks quotation marks, the Windows service control manager may attempt to execute malicious binaries placed by a local, authenticated user in a directory earlier in the path.

The exploitation of this vulnerability allows a local user to achieve privilege escalation to SYSTEM level. This represents a critical risk as it grants an attacker full control over the affected system, enabling the potential for data theft, the installation of persistent malware, and the complete compromise of the host machine. The CVSS score of 8.4 reflects the high severity associated with full local system compromise.

Immediate Action: As no specific patch version is documented, administrators should restrict file system permissions on the installation directory to prevent unauthorized users from placing malicious executables in the path. If the software is no longer required, uninstalling the application is the most effective way to eliminate this attack surface.

Proactive Monitoring: Monitor system logs for unauthorized service creation or modifications to service configurations. Review access control lists (ACLs) on the C:\Program Files (x86)\ directory to ensure that non-privileged users lack write access to subdirectories.

Compensating Controls: Ensure that the Principle of Least Privilege is strictly enforced on all Windows hosts, preventing standard users from modifying system files or directories where services are installed.

Public Exploit Available: Yes, a functional exploit proof-of-concept exists via the Exploit-DB entry 50764.

Given the availability of a public exploit and the severity of privilege escalation, this vulnerability poses a significant risk to local system integrity. Organizations should prioritize removing or restricting access to the vulnerable Connectify Hotspot installation. If the software is essential for business operations, ensure that standard users are strictly prevented from writing to the directory where the ConnectifyService binary is located.