Executive brief
Fortitude HTTP, a web server for Windows, contains a configuration flaw in how its background service is registered. A local user with limited access to the computer can exploit this to run their own malicious programs with full administrative (SYSTEM) privileges. This could lead to a complete takeover of the host machine, typically occurring when the system reboots or the service restarts.
Technical details
Fortitude HTTP 1.0.4.0 is vulnerable to an unquoted service path (CWE-428) within its Windows service registration. The service binary path (C:\Program Files\NetworkDLS\Fortitude HTTP\Bin\FortitudeSvc.exe) lacks quotation marks, allowing a local attacker with write permissions to intermediate directories to place a malicious executable (e.g., C:\Program.exe) that the Windows Service Control Manager will execute instead of the intended binary. Because the service is configured to run as LocalSystem, the attacker's code executes with elevated privileges. This vulnerability requires local access to the file system and is triggered during service startup or system reboot. While version 1.0.4.0 is specifically identified, later versions like 1.0.4.2 are available which may address the issue.
Affected products
- Networkdls Fortitude HTTP 1.0.4.0
Timeline
- 2016-10-05: disclosed: Initial exploit published on Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published