CVE-2023-54353: Chromacam Privilege Escalation Flaw

CVE-2023-54353 Overview

CVE-2023-54353 is an unquoted service path vulnerability in Chromacam 4.0.3.0 from Personify Inc. The flaw resides in the PsyFrameGrabberService Windows service, which registers an executable path containing spaces without surrounding quotation marks. Local attackers with write access to directories along the unquoted path can place a malicious binary that Windows will execute instead of the legitimate service executable. Because the service runs as LocalSystem and starts automatically at boot, successful exploitation results in privilege escalation from a standard user to full system control. The weakness is classified as [CWE-428] Unquoted Search Path or Element.

Critical Impact
A local user who can write to C:\ or an intermediate path directory can execute arbitrary code as LocalSystem at service startup, achieving full host compromise.

Affected Products

Chromacam 4.0.3.0 (Personify Inc.)
Windows installations registering the PsyFrameGrabberService service
Default install path under C:\Program Files (x86)\Personify\

Discovery Timeline

2026-06-19 - CVE-2023-54353 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2023-54353

Vulnerability Analysis

The PsyFrameGrabberService is installed by Chromacam 4.0.3.0 with an ImagePath registry value that contains spaces but no surrounding quotes. When the Windows Service Control Manager (SCM) launches the service, it parses the path token by token, attempting to execute each prefix as an executable. A path such as C:\Program Files (x86)\Personify\PsyFrameGrabberService.exe is evaluated by the SCM as candidate executables C:\Program.exe, C:\Program Files (x86)\Personify\PsyFrameGrabberService.exe, and intermediate variants.

If a file named Program.exe exists at C:\, or Personify.exe exists at C:\Program Files (x86)\, Windows runs that binary in place of the intended service. The substituted process inherits the LocalSystem security context configured for the service. This grants the attacker SYSTEM privileges on the host, enabling credential theft, persistence, and tampering with security controls.

Root Cause

The root cause is improper quoting of the service binary path during installation. The installer writes the ImagePath value to HKLM\SYSTEM\CurrentControlSet\Services\PsyFrameGrabberService without wrapping the full path in double quotes. Microsoft documentation requires quoted paths whenever an executable location contains whitespace, and the omission triggers SCM path-parsing behavior that is documented but commonly overlooked.

Attack Vector

Exploitation requires local access and the ability to write a file to C:\ or to an intermediate directory along the unquoted path. On default Windows installations, the root of C:\ allows authenticated users to create files, which makes C:\Program.exe the most reliable drop location. The attacker stages a malicious executable, then waits for the next system reboot or service restart. When the SCM launches PsyFrameGrabberService, it executes the planted binary as LocalSystem. No network access or user interaction is required beyond initial local logon.

Verified technical details and proof-of-concept material are documented in the Exploit-DB #51210 entry and the VulnCheck Chromacam Advisory.

Detection Methods for CVE-2023-54353

Indicators of Compromise

Unexpected executables named Program.exe, Program Files.exe, or Personify.exe located directly under C:\ or C:\Program Files (x86)\.
Process creation events showing PsyFrameGrabberService starting a binary outside C:\Program Files (x86)\Personify\.
Service start events (Event ID 7036) for PsyFrameGrabberService followed by child processes running as NT AUTHORITY\SYSTEM from non-standard paths.

Detection Strategies

Query the registry value HKLM\SYSTEM\CurrentControlSet\Services\PsyFrameGrabberService\ImagePath and flag entries that contain spaces but lack enclosing quotes.
Enumerate all Windows services with wmic service get name,pathname,startmode and filter for unquoted paths that include whitespace.
Hunt for file creation events on C:\ where the filename begins with Program and the extension is .exe, .bat, or .cmd.

Monitoring Recommendations

Enable Windows Security auditing for object access on the root of system drives to capture write attempts by non-administrative users.
Forward Sysmon Event ID 1 (process creation) and Event ID 11 (file create) to a centralized log platform for path-based correlation.
Alert on any new auto-start service binary located outside standard Program Files or Windows directories.

How to Mitigate CVE-2023-54353

Immediate Actions Required

Inventory hosts running Chromacam 4.0.3.0 and identify systems where PsyFrameGrabberService is installed.
Manually quote the service ImagePath value in the registry to prevent SCM misparsing until a vendor patch is available.
Remove write permissions for non-administrative users on C:\ and any intermediate directory containing the service binary.

Patch Information

No vendor patch is referenced in the published CVE data. Administrators should monitor the Personify Inc. homepage and the Chromacam download page for an updated release that installs the service with a quoted path. Until a fixed build is available, apply the configuration workarounds below.

Workarounds

Rewrite the ImagePath registry value to wrap the full executable path in double quotes, for example "C:\Program Files (x86)\Personify\PsyFrameGrabberService.exe".
Restrict the service start type to Manual or Disabled on systems that do not require Chromacam functionality.
Apply NTFS access control lists denying Authenticated Users the Create files / Write data permission on C:\ and on any directory along the service path.
Uninstall Chromacam 4.0.3.0 from systems that do not have a business need for the application.

bash

# Configuration example: quote the service ImagePath and harden C:\
reg add "HKLM\SYSTEM\CurrentControlSet\Services\PsyFrameGrabberService" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files (x86)\Personify\PsyFrameGrabberService.exe\"" /f
icacls C:\ /remove:g "Authenticated Users"
sc config PsyFrameGrabberService start= demand