A local privilege escalation vulnerability in the OCS Inventory NG Windows Agent allows low-privileged users to achieve full system-level control.

The application is affected by an unquoted service path vulnerability (CWE-428), which occurs because the service binary path contains spaces and is not enclosed in quotation marks. This allows a local attacker with standard user privileges to place a malicious executable within the path hierarchy, which the service will then execute with SYSTEM-level privileges upon restart.

Successful exploitation of this vulnerability results in a total compromise of the affected host. An attacker who has already gained limited local access can escalate their privileges to the highest level, effectively bypassing all local OS-level security controls. Given the CVSS score of 8.4, this represents a high-severity threat that could lead to data theft, lateral movement within the network, or persistent malware installation.

Immediate Action: Update the OCS Inventory NG Windows Agent to version 2.3.1.0 or later to resolve the unquoted service path configuration.

Proactive Monitoring: Review system service configurations for any services utilizing unquoted paths, and monitor event logs for unexpected service restarts or new unauthorized executables created within the C:\Program Files directory.

Compensating Controls: If immediate patching is not feasible, ensure that standard users do not have write permissions to the C:\Program Files or C:\Program Files (x86) directories to prevent the placement of malicious binaries.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 51389).

This vulnerability presents a significant risk to the integrity and security of any Windows system running the OCS Inventory NG Agent. Organizations should prioritize updating to version 2.3.1.0 immediately to eliminate the possibility of local privilege escalation. Ensuring that service paths are properly quoted and restricted is a standard security practice that must be verified across all deployed agents.