A high-severity unquoted search path vulnerability in Hasleo Backup Suite allows local users to escalate privileges to LocalSystem, potentially leading to full system compromise.

The HasleoBackupSuiteService is registered with an unquoted executable path containing spaces, which allows an attacker to manipulate the service search order. By placing a malicious binary in a path token that the service resolves, a local, non-privileged user can execute code with LocalSystem privileges.

Successful exploitation allows a local attacker to gain full control over the affected system. This facilitates unauthorized access to sensitive data, installation of persistent backdoors, and potential lateral movement across the network. Given the CVSS score of 7.0, this represents a significant risk to system integrity and confidentiality, particularly in environments where multiple users share access to a single machine.

Immediate Action: Since no specific patch version is currently identified, administrators should manually inspect the service configuration using the command "sc qc HasleoBackupSuiteService" and ensure the ImagePath is properly quoted in the Windows Registry.

Proactive Monitoring: Monitor system logs for unauthorized attempts to modify service configurations or the creation of suspicious executables in root directories such as "C:\Program.exe".

Compensating Controls: Restrict write permissions on the "C:" drive and the "C:\Program Files" directory to prevent unprivileged users from placing malicious binaries in locations that the service might inadvertently execute.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research writeup by lakshayyverma.

Organizations should prioritize auditing the service configurations of Hasleo Backup Suite on all deployed endpoints. Because this vulnerability grants LocalSystem access to any local user, it poses a severe threat to internal security posture. Administrators should implement the recommended configuration changes immediately to remediate the unquoted path and prevent potential privilege escalation.