Network Inventory Advisor 5.0.26.0 Unquoted Service Path Privilege Escalation

The service binary path `C:\Program Files (x86)\ClearApps\Network Inventory Advisor\niaservice.exe` is stored without quotes [ref_id=1]. When Windows Service Control Manager starts the service, it resolves the path by treating each space as a delimiter, causing it to attempt execution of `C:\Program.exe`, `C:\Program Files (x86)\ClearApps\Network.exe`, etc. A local attacker who can write to any of these intermediate directories can plant a malicious executable that will run with **LocalSystem** privileges when the service starts (auto-start is enabled) [ref_id=1]. No authentication beyond local filesystem access is required. An attacker with unprivileged access can place a payload in a directory like `C:\Program Files (x86)\ClearApps\Network.exe` to hijack the service startup.

The advisory does not include a vendor patch. The standard remediation for an unquoted service path vulnerability is to enclose the binary path in double quotes in the service configuration, e.g. `"C:\Program Files (x86)\ClearApps\Network Inventory Advisor\niaservice.exe"`. This prevents the Service Control Manager from misinterpreting spaces as argument separators. Without vendor confirmation, administrators should manually apply this fix or restrict write permissions on all directories in the path to prevent malicious executable placement.

The exploit-db entry does not provide reproduction steps beyond showing the `sc qc niaservice` output that reveals the unquoted path. No full PoC script is included.