Fortitude HTTP 1.0.4.0 Unquoted Service Path Elevation of Privilege
Description
Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting the service binary path. Attackers can insert malicious executables in the system root path that execute with SYSTEM privileges during service startup or system reboot.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: =1.0.4.0
Patches
Vulnerability mechanics
Root cause
"Unquoted service binary path allows Windows to misinterpret the path and execute an attacker-controlled file."
Attack vector
A local, non-privileged user can exploit the unquoted service path by placing a malicious executable in a directory that Windows will search before the real binary. Because the path `C:\Program Files\NetworkDLS\Fortitude HTTP\Bin\FortitudeSvc.exe` is not enclosed in quotes, Windows interprets each space as a separator and attempts to execute `C:\Program.exe`, then `C:\Program Files\NetworkDLS\Fortitude.exe`, and so on. An attacker who can write to a location earlier in the path (e.g., `C:\Program.exe`) can cause their payload to run with SYSTEM privileges when the service starts or the system reboots [ref_id=1].
Affected code
The vulnerable component is the Fortitude HTTP service (version 1.0.4.0) installed by Netgear Genie. The service binary path is `C:\Program Files\NetworkDLS\Fortitude HTTP\Bin\FortitudeSvc.exe /RunService`, which is unquoted and contains spaces.
What the fix does
The advisory does not include a patch. To remediate the vulnerability, the service binary path must be enclosed in quotation marks (e.g., `"C:\Program Files\NetworkDLS\Fortitude HTTP\Bin\FortitudeSvc.exe" /RunService`) so that Windows treats the entire string as a single path. Without a patch from the vendor, users should manually quote the service path or restrict write permissions on the directories in the path to prevent insertion of malicious executables.
Preconditions
- inputThe attacker must have local access to the system and the ability to write a file to a directory that appears earlier in the unquoted service path (e.g., C:\ or C:\Program Files\NetworkDLS\)
- configThe Fortitude HTTP service must be configured with an unquoted binary path and run with SYSTEM privileges
Reproduction
1. Open a command prompt and run `sc qc "Fortitude HTTP"` to confirm the unquoted service path. 2. Place a malicious executable named `Program.exe` in `C:\` or `Fortitude.exe` in `C:\Program Files\NetworkDLS\`. 3. Restart the service or reboot the system; the malicious executable will execute with SYSTEM privileges.
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.exploit-db.com/exploits/40461mitreexploit
- www.vulncheck.com/advisories/fortitude-http-unquoted-service-path-elevation-of-privilegemitrethird-party-advisory
- www.networkdls.commitreproduct
- www.networkdls.com/Software/View/Fortitude_HTTPmitreproduct
News mentions
0No linked articles in our index yet.