A local privilege escalation vulnerability in Tftpd32 SE 4.60 allows attackers to achieve system-level code execution by leveraging an unquoted service path.

The application suffers from an unquoted service path vulnerability (CWE-428) in the Tftpd32_svc service. A local user with low privileges can place a malicious executable in a directory that the service path parses incorrectly, resulting in the execution of the attacker code with SYSTEM privileges.

The ability to escalate privileges to the SYSTEM level provides an attacker with complete control over the affected host. This severity (CVSS 8.4) reflects the high impact on confidentiality, integrity, and availability, as a compromised service can be used to install persistent backdoors, exfiltrate sensitive data, or disable security controls across the entire system.

Immediate Action: Administrators should update Tftpd32_SE to the latest available version or, if no patch is provided by the vendor, manually quote the service path in the Windows Registry or disable the affected service.

Proactive Monitoring: Review Windows System Event logs for unexpected service restarts or new executable creation events within the C:\Program Files (x86)\ directory structure.

Compensating Controls: Implement strict file system permissions on the C:\Program Files (x86)\ directory to prevent non-privileged users from creating or modifying files in paths used by system services.

Public Exploit Available: Yes, a proof-of-concept exists as documented in ExploitDB entry 51076.

The risk associated with this vulnerability is significant due to the potential for full system compromise. Organizations running Tftpd32_SE 4.60 must prioritize restricting local user permissions or applying the necessary configuration changes to the service path to prevent unauthorized code execution. If the software is no longer maintained, consider replacing it with a more secure alternative.