A local privilege escalation vulnerability in the ArcSoft Exchange Service allows authenticated attackers to execute arbitrary code with system-level permissions.

The application utilizes an unquoted service path for the ArcSoft Exchange Service, which is a flaw categorized under CWE-428. A local attacker with low privileges can place a malicious executable in the path, which the service will then execute with SYSTEM privileges upon restart.

The ability for a local user to escalate privileges to the SYSTEM level poses a severe risk to organizational security, effectively granting an attacker full control over the affected host. This vulnerability, which carries a CVSS score of 8.4, facilitates complete system compromise, potential data exfiltration, and the installation of persistent backdoors, leading to significant reputational and operational damage.

Immediate Action: As no official patch is currently available, administrators should manually secure the service path by quoting the binary path or restricting write permissions on the directory containing the vulnerable service.

Proactive Monitoring: Monitor system logs for unauthorized service modifications or the execution of unexpected binaries within the C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\ directory.

Compensating Controls: Implement strict file system permissions to ensure only authorized administrators can write to the directory path associated with the ArcSoft Exchange Service.

Public Exploit Available: Yes, a functional exploit exists via ExploitDB (EDB-ID 51393).

Given the availability of a public exploit and the high severity of potential privilege escalation, organizations must treat this vulnerability with urgency. Administrators should prioritize restricting write access to the affected directory and consider disabling the ArcSoft Exchange Service if it is not required for core business operations until a vendor-supplied patch is made available.