A local unquoted service path vulnerability in Mediconta 3.7.27 allows attackers to achieve arbitrary code execution with LocalSystem privileges.

The application utilizes an unquoted service path for the servermedicontservice component. A local attacker with low privileges can exploit this by placing a malicious executable in the directory tree, causing the system to execute the attacker's code with LocalSystem permissions during service startup.

Successful exploitation of this vulnerability results in full system compromise, as the injected code executes with the highest level of system privileges. This could lead to total loss of confidentiality, integrity, and availability for the affected host. Given the CVSS score of 8.4, this flaw poses a high risk to organizational security, particularly in environments where local user access is permitted.

Immediate Action: As no official patch is currently available, administrators should manually remediate the service path by adding double quotes to the binary path in the Windows Registry (HKLM\SYSTEM\CurrentControlSet\Services\servermedicontservice) to ensure the path is correctly parsed.

Proactive Monitoring: Monitor system logs for unauthorized service installations or modifications to the directory structure within C:\Program Files (x86).

Compensating Controls: Implement strict file system permissions on the installation directory to prevent non-privileged users from writing or modifying files within the path.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the Exploit Database (EDB-ID: 51064).

The severity of this vulnerability, combined with the availability of public exploit documentation, necessitates immediate attention. Administrators must prioritize the manual configuration of the service path to prevent potential privilege escalation. Ensure that access controls are strictly enforced on the server to mitigate the impact of this local-access flaw until an official vendor update is released.