A local privilege escalation vulnerability in Emerson PAC Machine Edition 9.80 allows authenticated local users to execute malicious code with elevated system privileges.

The TrapiServer service utilizes an unquoted executable path, which allows an attacker with local access to inject a malicious binary into the file system, causing it to execute with LocalSystem permissions during service startup.

Successful exploitation of this vulnerability permits a local user to gain full administrative control over the affected system. Given the CVSS score of 8.4, this represents a critical risk to operational technology environments, as compromised machines could lead to unauthorized control of industrial processes, data theft, or complete system instability.

Immediate Action: Upgrade to a patched version of Emerson PAC Machine Edition as provided by the vendor, or contact Emerson support to obtain the necessary configuration updates to quote the service path.

Proactive Monitoring: Review Windows service configurations for unquoted paths using tools like wmic and monitor system logs for unexpected service restarts or unauthorized binary execution in the PAC Machine Edition installation directories.

Compensating Controls: Restrict local file system write permissions to the installation path of the TrapiServer service to prevent unauthorized actors from placing malicious binaries in the vulnerable directory.

Public Exploit Available: Yes, a proof of concept exists and is documented in the Exploit-DB entry 50745.

The severity of this flaw necessitates immediate attention, particularly in industrial environments where PAC Machine Edition is used to manage critical control systems. Administrators should prioritize verifying their software build and applying vendor-supplied patches or path-quoting configurations to eliminate the local privilege escalation vector.