Loading story…
A high-severity privilege escalation vulnerability tracked as CVE-2023-54353 affects Chromacam 4.0.3.0 through an unquoted Windows service path in PsyFrameGrabberService. The service binary is configured as C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe without quotation marks, while the service starts automatically and runs with LocalSystem privileges. An attacker with existing local access and the ability to write to affected directories can abuse Windows path parsing to place a malicious executable and have it launched with elevated rights when the service starts.
Public exploit details published on Exploit-DB describe planting files such as Program.exe or a rogue PsyFrameGrabberService.exe in writable locations including C:\ or parts of C:\Program Files (x86)\Personify\. The issue is rated 8.5 under CVSS 4.0 and 7.8 under CVSS 3.1, and is described as not remotely exploitable because it requires local write access. Recommended remediation is to properly quote the PsyFrameGrabberService path and verify the service configuration after the change.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry for CVE-2023-54353 documented the Chromacam 4.0.3.0 unquoted service path privilege escalation flaw, including CVSS 4.0 and 3.1 scores and remediation guidance to properly quote the PsyFrameGrabberService path. The entry identifies VulnCheck as the source and notes the issue is a local, not remote, privilege escalation vulnerability.
Exploit-DB published EDB-ID 51210 describing a local privilege escalation issue in Chromacam 4.0.3.0 caused by an unquoted service path in the PsyFrameGrabberService Windows service. The report states the service runs as LocalSystem and could allow code execution if a local attacker can place a malicious executable in a writable path segment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Newly documented vulnerabilities in **Spy Emergency build 23.0.205** and **sheed AntiVirus 2.3** allow local attackers to escalate privileges to **`LocalSystem`** through **unquoted service path** flaws classified as **`CWE-428`**. The affected services are **`SpyEmrgHealth`** and **`SpyEmrgSrv`** in Spy Emergency, and **`ShavProt`** in sheed AntiVirus. In each case, a low-privileged user can place a malicious executable in a path segment that Windows may incorrectly parse because the service executable path is not enclosed in quotes. If the vulnerable service is restarted or the host is rebooted, Windows can execute the attacker-controlled binary with **SYSTEM-level** privileges, creating a high-impact local privilege escalation path affecting confidentiality, integrity, and availability. The issues are tracked as **`CVE-2016-20056`** for Spy Emergency and **`CVE-2016-20061`** for sheed AntiVirus, with both records referencing vendor resources, **Exploit-DB**, and **VulnCheck** advisories.
Jun 29, 2026
A high-severity privilege-escalation flaw tracked as **CVE-2021-47985** affects **SAPSprint 7.60** on Windows by using an unquoted service path in the `SAPSprint` service configuration. The vulnerable binary path, `C:\Program Files\SAP\SAPSprint\sapsprint.exe`, can be abused by a local attacker who places a malicious executable in a searched path location, causing Windows to launch attacker-controlled code when the service starts. The service is configured to start automatically and runs as **LocalSystem**, making successful exploitation a path to full local privilege escalation. The issue was previously documented in an Exploit-DB entry by Brian Rodriguez, which described testing on **Windows 10 Enterprise 64-bit** and noted the absence of a CVE at the time. The newer CVE record classifies the bug as **not remotely exploitable** but rates it **High** severity, with **CVSS 3.1 7.8** and **CVSS 4.0 8.5**. Recommended mitigation includes quoting the service path, restricting write access in the affected directories, and monitoring for unauthorized executable placement in locations that Windows may search during service startup.
Jun 29, 2026
Microsoft disclosed several **Windows Simple Search and Discovery Protocol (SSDP) Service** elevation-of-privilege vulnerabilities, including `CVE-2026-32082`, `CVE-2025-48815`, `CVE-2025-47975`, and `CVE-2025-59196`, indicating a recurring security issue affecting the Windows SSDP component. The advisories identify the flaws as local privilege-escalation bugs that could allow an attacker with existing low-privilege access to gain **administrator-level** rights on a vulnerable system. For `CVE-2026-32082`, Microsoft said the issue stems from a **race condition** (`CWE-362`) and rated it **Important** with a **CVSS 3.1 score of 7.0**. The company described exploitation as requiring local access and low privileges, with **high impact** to confidentiality, integrity, and availability if successful. Microsoft said exploitation was considered less likely, was not publicly disclosed or known to be exploited at publication, and that a security update was available.
Jun 29, 2026