Compliance Impact

I don't know

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to escalate their privileges by executing malicious code with the highest system privileges (LocalSystem).

• The attacker needs local access to the machine to place the malicious executable.
• Once exploited, the attacker can gain full control over the system, potentially leading to data theft, system manipulation, or further compromise.
• Because the service runs automatically and with elevated privileges, the malicious code can persist and execute on system reboot or service restart.

Useful 0 Not Useful 0

Executive Summary

[{'type': 'paragraph', 'content': "The vulnerability in Wacom WTabletService version 6.6.7-3 is an unquoted service path issue affecting the 'WTabletServicePro' Windows service. Because the service executable path contains spaces and is not enclosed in quotes, a local attacker can place a malicious executable in a location that the system misinterprets when starting the service."}, {'type': 'paragraph', 'content': 'When the service restarts or the system reboots, the malicious executable can be run with elevated privileges (LocalSystem), allowing the attacker to execute unauthorized code with high-level access.'}] [2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the service executable path for unquoted spaces in the Wacom WTabletServicePro Windows service.

A common method is to inspect the service path using Windows command line tools to see if the path is unquoted and contains spaces.

• Run the command: sc qc WTabletServicePro
• Check the BINARY_PATH_NAME output for unquoted paths with spaces, for example: C:\Program Files\Tablet\Wacom\WTabletServicePro.exe

If the path is unquoted and contains spaces, the service is vulnerable to this unquoted service path issue.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately quote the service executable path to prevent the system from misinterpreting the path and executing malicious code.

Alternatively, you can rename the service executable path to remove spaces or move the executable to a path without spaces.

Ensure that only trusted users have local access to the machine to prevent insertion of malicious executables.

If available, update or patch the Wacom WTabletService to a version where this vulnerability is fixed.

Useful 0 Not Useful 0