A local unquoted search path vulnerability in Muse Group MuseHub 2.1.0.1567 presents a risk of privilege escalation for attackers with local system access.

This vulnerability is caused by an unquoted search path in the Muse.Updater.exe component, which runs as a Windows Service. A local attacker with low privileges could exploit this flaw to execute arbitrary code with elevated system permissions by placing a malicious executable in the path.

The exploitation of this flaw could lead to a full compromise of the affected host system. Because the vulnerability resides in a service, successful exploitation grants an attacker local administrative or system-level access, potentially leading to unauthorized data access, the installation of persistent backdoors, or lateral movement within the network. With a CVSS score of 7.0, this represents a high-severity risk that should be addressed to maintain the integrity and security of local workstations.

Immediate Action: Since a specific patch is not currently available, administrators should restrict local file system permissions on the directories associated with the MuseHub installation to prevent unauthorized binary placement.

Proactive Monitoring: Review Windows System and Security logs for unauthorized service installations or execution events originating from the MuseHub application directory.

Compensating Controls: Implement strict Application Control or Endpoint Detection and Response (EDR) policies to monitor for and block the execution of unsigned or unexpected binaries within the application path.

Public Exploit Available: Unknown.

Given the potential for privilege escalation, security teams should treat this vulnerability with high priority despite the requirement for local access. Organizations should monitor vendor communications for a formal patch and ensure that least privilege principles are applied to all user accounts on systems where MuseHub is installed.