An unquoted service path vulnerability in CONTPAQi AdminPAQ 14.0.0 allows a local attacker to execute arbitrary code with LocalSystem privileges.

The application utilizes an unquoted service path for the AppKeyLicenseServer, which runs with LocalSystem privileges. An attacker with local access can place a malicious executable in the path to hijack the service execution upon system startup.

Successful exploitation grants an attacker full administrative control over the underlying host. Given the CVSS score of 8.4, this represents a high-severity risk that could lead to complete system compromise, data theft, and lateral movement within the corporate network.

Immediate Action: Since no specific patch version is provided, administrators should manually secure the service path by quoting the executable path in the Windows Registry or by restricting permissions on the affected directory to prevent unauthorized file placement.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service startup failures or the creation of new, unauthorized executables within the C:\Program Files (x86)\Compac\ directory.

Compensating Controls: Implement strict file system permissions (Access Control Lists) on the installation directory to ensure only privileged administrators can write or modify files within the service path.

Public Exploit Available: Yes, a proof-of-concept exploit is available via Exploit-DB (EDB-ID: 50690).

This vulnerability presents a significant risk to system integrity by enabling local privilege escalation to LocalSystem. Organizations running CONTPAQi AdminPAQ 14.0.0 must prioritize restricting file system access to the affected installation paths and monitor for any signs of unauthorized binary placement until a formal vendor-provided patch is applied.