Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.
CVE-2025-41359 is a privilege escalation vulnerability in Small HTTP Server 3.06.36 caused by an unquoted service path that allows local attackers to execute arbitrary code. An attacker can place a malicious executable in a higher priority directory to hijack the service execution.
تؤثر هذه الثغرة على Small HTTP Server 3.06.36 من خلال مسار خدمة غير مقتبس يسمح لمهاجم محلي بتنفيذ كود عشوائي. يمكن للمهاجم وضع ملف تنفيذي ضار في مجلد بأولوية بحث أعلى ليتم تنفيذه بدلاً من الملف الشرعي.
This vulnerability affects Small HTTP Server 3.06.36 through an unquoted service path vulnerability that enables local privilege escalation and arbitrary code execution. Attackers can exploit this by placing malicious executables in directories with higher search priority.
Update Small HTTP Server to the latest patched version immediately. Quote the service executable path in the Windows registry at HKLM\System\CurrentControlSet\Services\[ServiceName] by enclosing the full path in quotation marks. Implement principle of least privilege for service accounts. Restrict local system access and monitor service execution logs for suspicious activity.
قم بتحديث Small HTTP Server إلى أحدث إصدار مصحح فوراً. أضف علامات اقتباس حول مسار الخدمة في سجل Windows في HKLM\System\CurrentControlSet\Services\[ServiceName]. طبق مبدأ أقل امتياز للحسابات الخدمية. قيد الوصول المحلي للنظام ومراقبة سجلات تنفيذ الخدمة.