Nssm-2.24 Privilege Escalation __full__ -

The vulnerability in primarily stems from the Unquoted Service Path vulnerability. While not necessarily a flaw in the NSSM binary itself, the way NSSM was typically configured or installed in older setups (or within software bundled with NSSM 2.24) created a security hole. The Mechanism: Unquoted Service Paths

Multiple privilege escalation vulnerabilities (tracked as VDE-2025-063 and VDE-2025-059) exist in Phoenix Contact Device and Update Management (DaUM) versions prior to 2025.3.1 due to . The weakness is classified under CWE-306 — Missing Authentication for Critical Function , as the product does not perform any authentication for functionality that requires a provable user identity.

: When the system reboots or the service restarts, Windows executes the malicious binary with high privileges, granting the attacker full administrative control over the machine. Exploit Step-by-Step: From User to SYSTEM

: An attacker could exploit this vulnerability by creating or modifying a service configuration in a way that NSSM would execute a command or load a DLL with elevated privileges. This could be achieved through specially crafted service definitions that are then processed by NSSM. nssm-2.24 privilege escalation

This article provides a comprehensive technical analysis of how privilege escalation occurs via NSSM 2.24, the underlying mechanisms of the exploit, and actionable mitigation strategies to secure your environment. The Core Concept: Windows Service Privilege Escalation

Once an attacker gains LocalSystem privileges, they have complete control over the compromised host. This includes the ability to read, modify, and delete any file; install software and drivers; create and modify user accounts; disable security controls; and tamper with audit logs.

: Local (Requires existing command-line or shell access to the host). The vulnerability in primarily stems from the Unquoted

The attacker generates a payload, such as an executable that adds a new user to the local Administrators group:

shell.exe runs as SYSTEM .

Evidence and observed occurrences

Attackers frequently target NSSM for several strategic reasons:

Windows handles unquoted spaces in service paths incorrectly, allowing an attacker to place a malicious executable in a location that the service will mistakenly run instead of the legitimate application. 2. Technical Details of the Attack