title: exacqVision Server Unquoted Service Path
description: ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.
problem types: CWE-428 Unquoted Search Path or Element
affected:
{
product: exacqVision Server
vendor: Exacq Technologies, Inc.
versions:
lessThan: 8.4, status: unknown, version: unspecified, versionType: custom
lessThanOrEqual: 9.4, status: unaffected, version: unspecified, versionType: custom
status: affected, version: 9.6
status: affected, version: 9.8
lessThan: unspecified, status: unaffected, version: next of 19.03, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.0
]
exploits: N/A
solutions: Upgrade to exacqVision Server 19.03
workarounds: Run Registry Editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\exacqVisionServer.  Modify the ImagePath for to include quotations around the entire file path.  Repeat this process for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dvrdhcpserver and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mdnsresponder