CVE-2023-53946
Unquoted Service Path in ArcSoft Exchange Service Enables Privilege Escalation
Publication date: 2025-12-19
Last updated on: 2025-12-19
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arcsoft | photostudio | 6.0.0.172 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2023-53946 is an unquoted service path vulnerability in Arcsoft PhotoStudio 6.0.0.172's ArcSoft Exchange Service. Because the service path is not enclosed in quotes, a local attacker can place a malicious executable in the unquoted path. When the service runs, it may execute this malicious code with system-level privileges, allowing the attacker to escalate their privileges on the system. [1, 2]
How can this vulnerability impact me? :
This vulnerability allows a local attacker to escalate their privileges to SYSTEM level by exploiting the unquoted service path. The attacker can execute arbitrary code with the highest system privileges, potentially gaining full control over the affected system, leading to unauthorized actions, data compromise, or system manipulation. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect the vulnerability by checking for the unquoted service path of the 'ADExchange' service. Use the command `sc qc "ADExchange"` to query the service configuration and confirm the binary path. Additionally, you can use WMIC to filter services that start automatically and exclude those in the Windows directory to identify unquoted paths. For example, use WMIC commands to list services and inspect their paths for missing quotes. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include placing quotes around the service path to prevent execution of malicious executables in unintended locations. You should also check for and remove any malicious executables placed in the unquoted path locations such as `C:\Program Files (x86)\Common.exe`. Restart the vulnerable service using `sc stop "ADExchange"` and `sc start "ADExchange"` or reboot the system after remediation to ensure changes take effect. [2]