Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService. A local attacker can place a malicious executable in directories such as C:\\ or C:\\Program Files (x86)\\Personify\\, and the service will run that executable with LocalSystem privileges when it starts automatically at boot, giving the attacker full system access. This flaw corresponds to CWE‑428.

The vulnerability affects Personifyinc's Chromacam product, specifically version 4.0.3.0. No other product versions are listed as impacted.

The CVSS score of 8.5 indicates a high impact if exploited. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; it requires write access to system directories or the ability to place files in C:\\ or the Personify installation folder. Once the service starts at boot, the injected binary runs with LocalSystem privileges, allowing the attacker to execute arbitrary code and potentially compromise the entire system.