Description
WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files <x86>\WINPAKPRO\WPCommandFileService Service.exe to inject malicious code that would execute with LocalSystem permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Honeywell | WIN-PACK PRO | 4.8 | — |
References
- ExploitDB-49692 exploit
- Honeywell Product Webpage product
- VulnCheck Advisory: WIN-PACK PRO 4.8 - 'WPCommandFileService' Unquoted Service Path third-party-advisory