Unquoted Service Path in USB Flash Drives Control Allows Code Execution

Publication date: 2025-12-17

Last updated on: 2025-12-17

Assigner: VulnCheck

Description

USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\USB Flash Drives Control\usbcs.exe' to inject malicious executables and escalate privileges on Windows systems.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-17

Last Modified

2025-12-17

Generated

2026-07-06

AI Q&A

2025-12-18

EPSS Evaluated

2026-07-05

NVD

CVE-2023-53912

Affected Vendors & Products

Vendor	Product	Version / Range
usb_flash_drives_control	usb_flash_drives_control	4.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-428	The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Attack-Flow Graph

Executive Summary

This vulnerability is an unquoted service path issue in USB Flash Drives Control 4.1.0.0. It occurs because the service configuration path 'C:\Program Files\USB Flash Drives Control\usbcs.exe' is not enclosed in quotes. This allows local attackers to insert malicious executables in the path, which the system might execute instead of the intended program, enabling them to run arbitrary code and escalate privileges on Windows systems.

Impact Analysis

The vulnerability can allow a local attacker to execute arbitrary code with escalated privileges on a Windows system. This means an attacker could potentially take control of the affected system, leading to unauthorized actions or access.

Hi! I’m here to help you understand CVE-2023-53912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70