NetDrive 2.6.12 has an unquoted service path in the Netdrive2_Service_Netdrive2 service. Because the executable path is not surrounded by quotation marks, the Windows service loader may misinterpret the path, allowing a local user to place a malicious executable in the system root directory; the service will launch it with SYSTEM privileges during startup or reboot, giving the attacker full control of the machine. The weakness is a classic unquoted service path flaw (CWE-428) that enables arbitrary code execution with elevated rights.

The affected product is NetDrive, version 2.6.12. It is distributed by NetDrive. No other versions or platforms are listed.

The CVSS score of 8.5 indicates severe risk, while the EPSS score is unavailable and the vulnerability is not listed in CISA KEV. The likely attack vector is local: a user who can run programs on the machine may create the malicious file in the system root directory or gain write access to the root path. Once the service restsarts or the system reboots, the attacker’s code runs with SYSTEM privileges, enabling full control, data tampering, and persistence.