CVE-2023-54353: Chromacam Unquoted Service Path Privilege Escalation

Technical summary

CVE-2023-54353 is an unquoted service path vulnerability (CWE-428) affecting Chromacam 4.0.3.0's PsyFrameGrabberService. When a Windows service is registered with an unquoted executable path containing spaces, the operating system interprets the path ambiguously. For example, an unquoted path like C:\Program Files (x86)\Personify\PsyFrameGrabberService.exe will cause Windows to search for and execute C:\Program.exe first, then C:\Program Files (x86)\Personify\PsyFrameGrabberService.exe if the first is not found. An attacker with write permissions to C:\ or intermediate directories such as C:\Program Files (x86)\Personify\ can place a trojanized executable in the search path, gaining execution with LocalSystem privileges when the service auto-starts at boot or is manually started.

Business impact

Successful exploitation results in local privilege escalation and arbitrary code execution with LocalSystem privileges, the highest privilege level in Windows. An attacker can install persistent backdoors, steal sensitive data, modify or delete files, disable security controls, or pivot to other systems on the network. For organizations using Chromacam (typically in streaming, content creation, or virtualization scenarios), this creates a path for a low-privilege local user to compromise the entire system and potentially the broader infrastructure.

Affected systems

Chromacam version 4.0.3.0 is affected. Users should verify with Personify Software whether earlier versions contain the same vulnerability and whether patched versions are available. The vulnerability requires local access, so it primarily affects shared workstations, multi-user systems, and environments where standard users have write access to program installation directories or the C:\ root.

Exploitability

Exploitability is moderate to high in practical scenarios. The attack requires local access and write permissions, which is a meaningful constraint, but many systems grant standard users write access to their own user profile and sometimes to shared application folders. The attack is reliable once those conditions are met—no user interaction is required, no additional vulnerabilities need to be chained, and the malicious code runs automatically at boot with no warnings. Exploitation does not require code execution vulnerability; file placement alone is sufficient.

Remediation

Personify Software should issue a patch that registers the PsyFrameGrabberService with a properly quoted executable path (e.g., '"C:\Program Files (x86)\Personify\PsyFrameGrabberService.exe"'). Verify the availability of patched versions against the vendor advisory. As an interim mitigation, restrict write permissions on C:\, C:\Program Files, and C:\Program Files (x86)\ directories to administrators only, ensuring standard users cannot place files in these locations. Monitor file creation events in these directories.

Patch guidance

Check Personify Software's official advisory and download pages for a patched version of Chromacam. Verify the patch notes confirm the service path has been quoted. Deploy patches to all affected systems, prioritizing those where standard users have local access. Testing in a non-production environment is recommended before broad rollout. After patching, verify the service registration in the Windows Registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PsyFrameGrabberService) to confirm the ImagePath value is properly quoted.

Detection guidance

Monitor Windows Event Viewer for service creation or modification events (Event ID 7045 in System log). Alert on any changes to the PsyFrameGrabberService ImagePath in the Registry. Monitor for file creation events (e.g., Program.exe, PsyFrameGrabberService.exe) in C:\, C:\Program Files, and C:\Program Files (x86)\ directories by non-administrative accounts. Endpoint Detection and Response (EDR) tools should flag execution of unexpected binaries from these locations or unusual child processes spawned during service startup. File integrity monitoring on the Chromacam installation directory can detect unauthorized modifications.

Why prioritize this

This vulnerability merits high priority because it enables unauthenticated local privilege escalation to LocalSystem with no user interaction required. The CVSS 3.1 score of 7.8 (HIGH) reflects complete compromise of system confidentiality, integrity, and availability. While it requires local access, many environments cannot fully restrict that. The automatic boot-time execution and lack of required exploitation complexity make it attractive to adversaries with initial system access. Organizations should patch promptly, particularly systems supporting multiple users or where endpoint security maturity is inconsistent.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is assigned with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Attack Vector (Local) and low Attack Complexity reflect that the vulnerability requires local access but is trivial to exploit once that access exists. Privileges Required (Low) acknowledges that a standard user with write access can exploit it. No User Interaction (N) is correct—the attacker simply places a file and waits for the service to start. The impact is complete: high Confidentiality (arbitrary code execution allows data theft), high Integrity (arbitrary code execution allows modification), and high Availability (arbitrary code execution allows denial of service). The score does not reflect KEV status or active exploitation metrics, which are tracked separately.

Frequently asked questions