Post-incident, the patch was applied, and the company also deployed a group policy to audit all service paths across their 1,200 endpoints. They found 11 other unquoted paths in legacy software, highlighting that Active Webcam was just the tip of the iceberg.

BINARY_PATH_NAME : C:\Program Files\Active Webcam\awservice.exe START_TYPE : 2 AUTO_START SERVICE_START_NAME : LocalSystem

"C:\Program Files\Active WebCam\webcam.exe"

Windows will attempt to locate and execute files in the following order:

For example, consider this path for Active Webcam: C:\Program Files\Active Webcam\Webcam.exe

Vulnerable: C:\Program Files (x86)\Active Webcam\WebcamService.exe -run

Value should be: "C:\Program Files\Active Webcam 115\webcamservice.exe"

As the cybersecurity community continues to battle both sophisticated zero-days and simple misconfigurations, the unquoted service path remains a powerful reminder that sometimes, the most dangerous bugs are the easiest to fix.

(Confirmed).

If a local attacker has permission to write to the C:\ directory or the C:\Program Files\ directory, they can place a malicious executable named Program.exe or Active.exe in those locations. The next time the service restarts, Windows will execute the attacker's payload instead of the legitimate service binary. Because services often run under the NT AUTHORITY\SYSTEM account, this leads to full local privilege escalation. The Active Webcam 11.5 Vulnerability

Version 11.5 (build 115) was particularly affected by a service path misconfiguration that, until now, exposed users to a classic Windows privilege escalation attack.