关键漏洞信息 漏洞描述 CVE: Unquoted Service Path → Local Privilege Escalation in VeePN AVService (v1.6.2) Summary: VeePN 1.6.2 installs AVService with an unquoted ImagePath: - Impact: Because the path contains spaces and is unquoted, Windows may load an executable from earlier tokens (e.g., ). On the affected host, is writable, allowing a local attacker with file-write access to place a malicious binary and gain the service account (typically SYSTEM) when the service starts. 严重性 Severity: High CWE: CWE-428 (Unquoted Search Path or Element) Suggested CVSS v3.1: 7.8 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 影响产品 Affected Product: VeePN AVService — v1.6.2 影响 Impact: Local file-write + service restart → local privilege escalation to service account (full system compromise possible). 检测方法 Detection: - → check BINARY_PATH_NAME for missing quotes. - Registry: - Check ACLs on early path tokens (e.g., ) for non-admin write permission. 参考链接 https://veepn.com/vpn-apps/ https://cwe.mitre.org/data/definitions/428.html