Unquoted Service Path in ProtonVPN 4.4.1 Enables Local Privilege Escalation on Windows
What Happened — An unquoted service path in the ProtonVPN WireGuard Windows service (v4.4.1) allows a local user to place malicious code in the system‑root directory. When the service starts, Windows may execute that code with the service’s LocalSystem privileges, resulting in a privilege‑escalation exploit. The issue is documented in Exploit‑DB #52624 and has been verified on Windows 10 Pro x64.
Why It Matters for Compliance & Audit Readiness
- The flaw illustrates a classic control‑gap: missing hardening of service‑installation parameters, a scenario SOC 2 expects organizations to detect, remediate, and retain evidence for.
- Continuous‑control monitoring (e.g., automated scanning for unquoted service paths) provides audit‑ready proof that the System Operations and Change Management criteria are being enforced.
- Verisq’s Control Mapping capability can automatically map this misconfiguration to the relevant SOC 2 controls and collect evidence for auditors.
Who Is Affected — Any organization that deploys ProtonVPN 4.4.1 on Windows workstations or servers, spanning technology, finance, healthcare, and remote‑work environments.
Recommended Actions
- Immediately verify the service path for all ProtonVPN installations; quote the full executable path or relocate the binary to a path without spaces.
- Deploy a configuration‑audit script (e.g., PowerShell Get‑Service) to detect unquoted service paths across the fleet and log findings as compliance evidence.
- Update to a patched ProtonVPN version (if available) or apply a hardening baseline that enforces proper service configuration.
Source: Exploit‑DB #52624
Technical Notes
- Attack vector: Local exploitation of an unquoted service path (Windows Service Misconfiguration).
- Impact: Execution of attacker‑controlled code with LocalSystem privileges.
- No CVE assigned (public exploit without vendor‑issued identifier).
Source: Exploit‑DB #52624