Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system pri…

Wing FTP Server version 6.0.7 contains an unquoted service path vulnerability (CVE-2019-25267) that allows local attackers to execute arbitrary code with elevated system privileges. The vulnerability exists in the service configuration where the binary path is not properly quoted, enabling attackers to inject malicious executables. When exploited, these malicious executables are launched with LocalSystem permissions, providing attackers with the highest level of system access. This is a local privilege escalation vulnerability that requires the attacker to have initial access to the system. The vulnerability affects Wing FTP Server specifically at version 6.0.7.