A local privilege escalation vulnerability in the Persits Software EmailAgent service allows low-privileged users to gain full system control.

The vulnerability stems from insecure permission assignments (CWE-732) within the BIN directory of the EmailAgent service. Local users with standard access can replace the service executable with a malicious file, which is then executed by the service running with LocalSystem privileges.

Successful exploitation of this vulnerability permits a local attacker to execute arbitrary code with the highest level of system privileges. This leads to complete host compromise, including the ability to install persistent backdoors, extract sensitive data, or move laterally across the network. Given the CVSS score of 8.4, this represents a high-severity risk to any organization hosting this software.

Immediate Action: Update the AspEmail software to the latest version provided by Persits Software that addresses these directory permission flaws.

Proactive Monitoring: Review system logs for unexpected process execution or modifications to files within the AspEmail installation directory. Monitor for the creation of new services or unauthorized changes to existing service configurations.

Compensating Controls: Restrict local user permissions on the server to prevent unauthorized access to the application installation directory. Implement Endpoint Detection and Response (EDR) solutions to flag suspicious file replacement activities or privilege escalation attempts.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 51380).

This vulnerability presents a significant risk because it allows an attacker who has already gained a foothold on the system to escalate their permissions to LocalSystem. Organizations must prioritize applying the vendor-supplied security updates to restrict directory access and prevent binary replacement. If patching is not immediately feasible, manually hardening the permissions on the BIN directory to remove write access for non-administrative users is strongly advised.