Executive brief
Brother SAPSprint, a utility used for SAP printing services, contains a configuration flaw that allows a local user to gain full administrative control over the computer. By placing a specifically named file in certain folders, an attacker can trick the system into running their own malicious software with high-level system privileges. This could lead to a complete takeover of the affected machine, including the ability to access sensitive data or disable security software.
Technical details
Brother SAPSprint 7.60 is vulnerable to an unquoted service path (CWE-428) within its service binary configuration. The 'SAPSprint' service points to a binary path (C:\Program Files\SAP\SAPSprint\sapsprint.exe) that lacks quotation marks, causing the Windows Service Control Manager to search for and potentially execute files with matching names in parent directories (e.g., C:\Program.exe). A local attacker with write permissions to the directory path can place a malicious executable that will be executed with LocalSystem privileges when the service automatically starts. This vulnerability requires local access to the target machine but results in a full privilege escalation. An exploit for this issue has been publicly documented.
Affected products
- Brother SAPSprint 7.60
Timeline
- 2021-06-21: disclosed: Vulnerability discovered by Brian Rodriguez
- 2021-06-25: other: Exploit published on Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published