Advanced System Care Service version 13.0.0.157 contains an unquoted service path flaw that allows a local attacker to execute arbitrary code with System privileges during service startup or system reboot. By placing a malicious executable in the system root, the unquoted path causes the operating system to launch that executable as the service process running under LocalSystem, thus granting the attacker administrative rights on the affected machine. The weakness is classified as CWE-428, indicating an unquoted service path vulnerability.

The product affected is Iobit Advanced System Care Service version 13.0.0.157. Any Windows system running this specific build of the service is susceptible, including deployments that have not applied an updated version with the path properly quoted.

The CVSS score of 8.5 signals high severity, and while the EPSS score is not available, the lack of a KEV listing does not diminish the potential impact for local attackers. Because the flaw requires local access, the attack vector is local; however, the ease of exploitation and the privilege escalation to LocalSystem make it a significant risk for systems that remain uncompromised. Prompt remediation is advised for all installations of the affected version.