A local privilege escalation vulnerability in the Clevo HotKey Clipboard service allows authenticated attackers to gain full system-level control.

The application utilizes an unquoted service path for the HKClipSvc service, which permits a local, non-privileged user to hijack the service execution by placing a malicious executable in the path hierarchy. This allows for code execution with LocalSystem privileges.

Successful exploitation grants an attacker full administrative control over the affected workstation or server. This level of access facilitates the installation of backdoors, theft of sensitive data, and potential lateral movement across the internal network. Given the CVSS score of 8.4, this vulnerability represents a high-risk security weakness that undermines the integrity of the operating system.

Immediate Action: Since no specific patch is currently available, administrators should disable or remove the vulnerable HKClipSvc service if it is not business-critical.

Proactive Monitoring: Review system logs for unauthorized service installations or modifications to the directory structure within C:\Program Files (x86)\ControlCenter.

Compensating Controls: Implement strict file system permissions on the affected path to prevent non-privileged users from creating or modifying files in the C:\Program Files (x86)\ControlCenter\ directory hierarchy.

Public Exploit Available: Yes — a proof-of-concept exploit is available via ExploitDB (EDB-ID: 51206).

The presence of an unquoted service path in a service running as LocalSystem is a critical security oversight. Organizations utilizing Clevo hardware or the affected Control Center software should prioritize restricting local user permissions to prevent unauthorized file placement. Until a formal vendor patch is released, disabling the affected service is the most effective method to eliminate this privilege escalation vector.