A local privilege escalation vulnerability in Tosibox Key Service allows authenticated low-privileged users to achieve full system compromise.

The application utilizes an unquoted service path, which permits a local user with low privileges to place a malicious executable in the system root path. This executable is subsequently triggered during the service startup process or system reboot with elevated system privileges.

Successful exploitation of this vulnerability results in full system compromise, as the attacker gains the same level of access as the vulnerable service. This poses a severe risk to organizational security, potentially leading to unauthorized data access, the installation of persistent backdoors, or complete operational disruption. With a CVSS score of 8.4, this vulnerability represents a high-severity threat that requires immediate attention despite the requirement for local access.

Immediate Action: Contact the vendor for specific patch information or guidance on securing the service path, as no public fix version is currently identified.

Proactive Monitoring: Review system logs for unauthorized service installations, unexpected executable files in the system root directory, and suspicious process spawning during system startup.

Compensating Controls: Implement strict file system permissions to prevent non-privileged users from writing files to the system root or service directories. Enforce the principle of least privilege to ensure that standard users cannot modify service configurations or binary locations.

Public Exploit Available: No (There is no confirmed weaponized exploit or public proof-of-concept repository available in the analyzed data.)

Given the high CVSS score and the ability for a local attacker to escalate privileges to the system level, this vulnerability poses a significant risk to endpoint integrity. Administrators should prioritize restricting file system access and monitor for unauthorized changes to service paths until a formal vendor patch is applied.