OKI sPSV Port Manager 1.0.41 contains an unquoted service path vulnerability in the sPSVOpLclSrv service. The flaw allows a local attacker to place a malicious executable in a directory referenced in the unquoted path. When the service restarts or the system reboots, the injected executable runs with LocalSystem privileges, granting the attacker complete control over the affected host.

The vulnerable product is OKI sPSV Port Manager version 1.0.41 from Oki. No additional affected versions are specified in the CNA data.

With a CVSS score of 8.5, this flaw is considered high severity. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited. However, the attack requires local access, so any compromised or physical user with ability to write to the service path directory can exploit this vector to elevate privileges. Once the service is restarted the malicious code will execute as LocalSystem.