An unquoted search path vulnerability in VeePN versions 1.6.0 through 1.6.2 allows a local attacker to execute arbitrary code with elevated privileges.

The vulnerability consists of an unquoted search path in the AVService executable (avservice.exe), which allows a local attacker to potentially hijack the search order to execute malicious binaries. The attack requires local access and is classified as having a high degree of complexity.

The exploitation of this vulnerability could lead to local privilege escalation, granting an attacker full control over the affected system. Given the CVSS score of 7.0, this represents a high-severity risk to system integrity and confidentiality, particularly in multi-user environments or systems where local access is shared.

Immediate Action: As no official patch is currently available from the vendor, users should restrict local file system permissions on the directory containing avservice.exe to prevent unauthorized modification.

Proactive Monitoring: Monitor system logs for the execution of unexpected binaries or services originating from the VeePN installation directory.

Compensating Controls: Implement strict endpoint security policies that prevent non-administrative users from writing files to protected program directories.

Public Exploit Available: No.

Organizations utilizing VeePN should prioritize restricting local access to the software installation path to mitigate the risk of privilege escalation. Given the lack of a vendor-provided patch, administrators must rely on defensive configuration and monitoring to protect against potential exploitation of this unquoted search path flaw.