A critical local privilege escalation vulnerability in the Telcel FLAME II USB Modem allows attackers to achieve SYSTEM-level code execution via an unquoted service path.

The software uses an unquoted service path for the application controller (CWE-428). A local attacker can place a malicious executable in a parent directory, which the service will execute with elevated system privileges upon startup.

Successful exploitation grants an attacker full control over the host machine, including the ability to install persistent malware, steal credentials, or pivot into the local network. With a CVSS score of 9.8, this vulnerability represents a severe risk to any workstation or server where this modem software is installed.

Immediate Action: Identify and uninstall the affected Telcel modem software if it is no longer required for operations.

Proactive Monitoring: Audit Windows services for unquoted paths using tools like PowerShell (e.g., Get-WmiObject win32_service) and monitor for the creation of unauthorized executables in the C:\Program Files (x86)\ directory.

Compensating Controls: Implement strict file system permissions on the C:\Program Files (x86)\Internet Telcel\ directory to prevent unauthorized users from writing files to the directory path.

Public Exploit Available: Yes — an entry exists on ExploitDB.

Organizations should audit their environment for the presence of this legacy modem software and remove it immediately. If the software is mission-critical, ensure strict access control policies are applied to the installation directory to prevent local privilege escalation.