CVE-2023-54338: Tftpd32 SE Privilege Escalation Flaw

CVE-2023-54338 Overview

CVE-2023-54338 is an unquoted service path vulnerability affecting Tftpd32 SE version 4.60. This security flaw allows local attackers to potentially execute arbitrary code with elevated privileges by exploiting the unquoted path in the service configuration. When the Windows service is started, the system may execute a malicious executable placed in the path, running it with system-level permissions.

Critical Impact

Local privilege escalation to SYSTEM-level permissions through malicious executable injection in the unquoted service path.

Affected Products

• Tftpd32 SE 4.60
• Windows systems running the tftpdsvc service with unquoted paths

Discovery Timeline

• 2026-01-13 - CVE CVE-2023-54338 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2023-54338

Vulnerability Analysis

This vulnerability is classified under CWE-428 (Unquoted Search Path or Element). When a Windows service executable path contains spaces and is not properly enclosed in quotation marks, Windows attempts to locate the executable by parsing the path at each space character. This behavior creates an opportunity for attackers to place malicious executables at intermediate path locations that Windows will execute instead of the intended service binary.

For example, if the Tftpd32 SE service is installed with an unquoted path like C:\Program Files\Tftpd32 SE\tftpd32.exe, Windows will sequentially attempt to execute:

1. C:\Program.exe
2. C:\Program Files\Tftpd32.exe
3. C:\Program Files\Tftpd32 SE\tftpd32.exe

An attacker with write access to C:\ or C:\Program Files\ can place a malicious executable named Program.exe or Tftpd32.exe respectively, which would be executed with the service's elevated privileges.

Root Cause

The root cause of this vulnerability is improper configuration of the Windows service path during installation. The Tftpd32 SE installer fails to enclose the service executable path in quotation marks when registering the service with the Windows Service Control Manager. This oversight allows the path parsing behavior of Windows to be exploited for privilege escalation.

Attack Vector

The attack requires local access to the target system. An attacker must have write permissions to one of the directories in the unquoted path before the actual executable location. The exploitation flow involves:

1. Identifying the unquoted service path using commands like wmic service get name,pathname,startmode
2. Placing a malicious executable in a writable directory along the path
3. Waiting for or triggering a service restart to execute the malicious payload with SYSTEM privileges

The vulnerability exploits the local attack vector, meaning physical or remote access to the system is required. However, once exploited, it provides complete system-level access, making it a significant privilege escalation vector. Technical details and proof-of-concept information are available at the Exploit-DB #51076 advisory.

Detection Methods for CVE-2023-54338

Indicators of Compromise

• Unexpected executables named Program.exe or Tftpd32.exe in root directories or intermediate paths
• New files created in C:\ or C:\Program Files\ directories with executable extensions
• Service configuration changes or unexpected service restarts for the tftpdsvc service
• Process creation events showing SYSTEM-level processes spawned from unusual directory locations

Detection Strategies

• Query Windows services for unquoted paths using wmic service get name,pathname,startmode | findstr /i /v """"
• Monitor file system for new executable creation in C:\, C:\Program Files\, and similar root directories
• Implement application whitelisting to block unauthorized executables from running with elevated privileges
• Use SentinelOne's behavioral AI to detect anomalous process creation patterns from service contexts

Monitoring Recommendations

• Enable Windows Security Event Log monitoring for service installation and modification events (Event IDs 7045, 4697)
• Configure SentinelOne to alert on new executable files created in system directories
• Monitor for process trees where SYSTEM-level processes spawn from non-standard paths
• Regularly audit service configurations for unquoted paths using automated scripts or security tools

How to Mitigate CVE-2023-54338

Immediate Actions Required

• Audit all Windows services for unquoted paths using wmic service get name,pathname,startmode
• Remediate the Tftpd32 SE service path by adding quotation marks around the executable path
• Review and restrict write permissions on directories in the service path hierarchy
• Consider uninstalling Tftpd32 SE if not actively required and no patch is available

Patch Information

No official patch information is currently available from the vendor. Administrators should manually remediate the service configuration or consider alternative TFTP server solutions. For more information about the software, refer to the GitHub tftpd64 Resource. Additional advisory details are available at the VulnCheck Advisory on tftpdsvc.

Workarounds

• Manually fix the unquoted service path by modifying the registry key at HKLM\SYSTEM\CurrentControlSet\Services\tftpdsvc to include quotation marks around the ImagePath value
• Remove write permissions for non-administrative users on directories in the service path
• Implement application control policies to prevent unauthorized executable execution
• Use file integrity monitoring to detect and alert on new executables in sensitive directories

# Fix unquoted service path for tftpdsvc
# Run in elevated Command Prompt or PowerShell

# Option 1: Using sc command to recreate service with quoted path
sc config "tftpdsvc" binPath= "\"C:\Program Files\Tftpd32 SE\tftpd32.exe\""

# Option 2: Using PowerShell to modify registry directly
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\tftpdsvc" -Name "ImagePath" -Value '"C:\Program Files\Tftpd32 SE\tftpd32.exe"'

# Verify the change
sc qc tftpdsvc