Lavasoft Web Companion versions 8.9.0.1091 through 12.1.3.1037 are vulnerable to privilege escalation via an unquoted service path, posing a significant risk of arbitrary code execution.

The application installs the DCIService.exe service using an unquoted service path. This allows an attacker who has already gained local write access to the file system to place a malicious executable in the path, resulting in code execution with elevated system privileges.

The ability for a local attacker to escalate privileges to system level represents a severe security risk. Successful exploitation could lead to full system compromise, unauthorized data access, and the potential for persistent malware installation, which may cause significant operational downtime and damage to system integrity. Given the CVSS score of 7.3, this flaw is considered a high-severity issue that requires immediate attention to prevent lateral movement or total host takeover.

Immediate Action: Since a specific patch version is not currently listed, administrators should restrict file system permissions on the installation directory to prevent unauthorized writes and monitor for any suspicious executables appearing in the path.

Proactive Monitoring: Audit the system for any unauthorized services or unexpected executable files located within the program directory structure.

Compensating Controls: Implement strict Access Control Lists (ACLs) on the service installation path to ensure that only authorized administrative users have write access to those directories.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked research reference on GitHub.

The severity of this vulnerability necessitates a proactive approach to system hardening. While awaiting formal vendor guidance or a patch, organizations must enforce the principle of least privilege regarding file system access. Securing the service path against unauthorized modifications is the most effective way to mitigate this risk until a permanent software update is provided by Lavasoft.