iFunbox 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service that allows local attackers to execute code with elevated privile…

iFunbox version 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service. This vulnerability allows local attackers to execute arbitrary code with elevated LocalSystem privileges. Attackers can exploit this by inserting a malicious executable into the unquoted service path. The malicious code executes when the service restarts, providing full system-level access. This represents a significant privilege escalation vulnerability affecting users of the iFunbox iOS management tool.