Executive Summary

The CVE-2026-33253 vulnerability affects SANUPS SOFTWARE by SANYO DENKI CO., LTD. It is caused by Windows services being registered with unquoted file paths. When the executable path of a Windows service contains spaces but is not enclosed in quotation marks, an attacker can exploit this to execute arbitrary code.

Specifically, a user with write permission on the root directory of the system drive can place a malicious executable in a folder path containing spaces. Because the path is unquoted, the system may run the malicious executable instead of the intended service executable, resulting in code execution with SYSTEM-level privileges.

Affected products include various versions of SANUPS SOFTWARE STANDALONE and SANUPS SOFTWARE, with fixed versions available to mitigate the issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker who has write access to the root directory of the system drive to execute arbitrary code with SYSTEM privileges. This means the attacker can gain full control over the affected system.

The impact includes unauthorized code execution, potential system compromise, and the ability to perform any actions that the SYSTEM user can, such as installing malware, stealing data, or disrupting system operations.

Because the vulnerability leverages a weakness in how Windows services are registered, it can be exploited locally by users with certain permissions, making it a serious security risk.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves Windows services registered with unquoted file paths. To detect it on your system, you should check for Windows services whose executable paths contain spaces but are not enclosed in quotation marks.'}, {'type': 'paragraph', 'content': 'A common method is to list all Windows services and inspect their ImagePath registry entries for unquoted paths containing spaces.'}, {'type': 'list_item', 'content': 'Use the command: sc qc <ServiceName> to query the configuration of a specific service and check the BINARY_PATH_NAME for unquoted paths.'}, {'type': 'list_item', 'content': 'Use PowerShell to find all services with unquoted paths containing spaces, for example:\nGet-ItemProperty HKLM:\\SYSTEM\\CurrentControlSet\\Services\\* | Where-Object { $_.ImagePath -match \' \' -and $_.ImagePath -notmatch \'"\' } | Select-Object PSChildName, ImagePath'}, {'type': 'paragraph', 'content': 'If you find any service executable paths with spaces that are not enclosed in quotes, those services are potentially vulnerable to this issue.'}] [1, 2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update or replace the affected SANUPS SOFTWARE versions with fixed versions provided by SANYO DENKI.

• For SANUPS SOFTWARE STANDALONE: Upgrade from version 1.0.1 or 1.1.0 to 1.1.4 to version 1.1.5. Version 1.0.1 requires uninstalling before installing 1.1.5, which requires reconfiguration.
• For SANUPS SOFTWARE versions 2.0.0 to 2.0.2: Update to version 2.0.3, retaining configuration settings.
• For SANUPS SOFTWARE versions 1.0.0 to 1.1.4: Uninstall the older versions and purchase and install version 3.0.1, which requires reconfiguration.

These updates fix the unquoted service path issue by properly quoting executable paths, preventing arbitrary code execution.

Additionally, ensure that users do not have write permissions on the root directory of the system drive, as this permission is required to exploit the vulnerability.

Useful 0 Not Useful 0