Executive brief
OKI sPSV Port Manager, a utility used for managing printer port communications, contains a security flaw that could allow a person with limited access to a computer to gain full administrative control. By placing a specially named file in a specific folder, an attacker can trick the system into running their malicious code with the highest possible system privileges. This typically occurs when the computer restarts or the printing service is cycled, potentially leading to a complete compromise of the affected workstation.
Technical details
The sPSVOpLclSrv service in OKI sPSV Port Manager 1.0.41 uses an unquoted executable path containing spaces (C:\Program Files\Okidata\smart PrintSuperVision\xml\ComApi\extend3\portmgrsrv.exe). This CWE-428 vulnerability allows a local attacker with file system write permissions to place a malicious executable (e.g., C:\Program.exe) that the Windows Service Control Manager will execute instead of the intended binary. Because the service is configured to run as LocalSystem, the attacker's code will execute with elevated privileges upon service restart or system reboot. Exploitation requires local access and the ability to write to a directory in the service path.
Affected products
- OKI sPSV Port Manager 1.0.41
Timeline
- 2020-11-08: disclosed: Initial discovery by researcher Julio Aviña
- 2020-11-09: other: Exploit code published to Exploit-DB
- 2026-05-16: advisory: NVD publication date