Executive brief
TFTP Broadband is a carrier-grade file transfer server used by telecommunications and defense organizations to manage device configurations and firmware. A security flaw allows a user with low-level access to the hosting Windows computer to trick the system into running a malicious program instead of the legitimate server software. If exploited, an attacker could gain full control over the server, potentially leading to data theft, service disruption, or a foothold for further attacks on the network.
Technical details
A CWE-428 (Unquoted Search Path or Element) vulnerability exists in the tftpt.exe service binary of TFTP Broadband version 4.3.0.1465. The service path is not enclosed in quotation marks and contains spaces (e.g., C:\Program Files\TFTP Broadband 4\tftpt.exe), allowing a local attacker with write permissions to the parent directories to place a malicious executable (such as C:\Program.exe) that Windows will execute instead of the intended service. Because the service is configured to run as LocalSystem, successful exploitation results in full privilege escalation. This can be triggered during service startup or a system reboot. An exploit for this vulnerability has been publicly disclosed.
Affected products
- Weird Solutions TFTP Broadband 4.3.0.1465 and earlier
Timeline
- 2020-05-07: disclosed: Vulnerability discovered by Erick Galindo
- 2021-05-10: other: Exploit code published on Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published