Executive brief
Windows Firewall Control is a utility used to manage and simplify Windows native firewall settings. A security flaw allows a local user with limited permissions to gain full administrative control over the computer. By placing a malicious file in a specific location, the attacker can trick the system into running their code with the highest possible system privileges when the computer restarts.
Technical details
Windows Firewall Control (wfcs.exe) suffers from an unquoted service path vulnerability (CWE-428). The service binary path contains spaces and lacks quotation marks, allowing a local attacker with write permissions to the parent directories (e.g., C:\) to plant a malicious executable (e.g., Program.exe). Because the path is unquoted, the Windows Service Control Manager will attempt to execute the planted file instead of the intended service binary. Upon a service restart or system reboot, the malicious code executes with LocalSystem privileges. This affects version 4.8.6.0 and potentially earlier versions.
Affected products
- Binisoft Windows Firewall Control 4.8.6.0 and earlier
Timeline
- 2016-09-24: disclosed: Original discovery by researcher zaeek
- 2016-10-03: other: Exploit published to Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published