Vulnerability · Published Jun 19, 2026 · Assigned by VulnCheck
CVE-2023-54353Chromacam 4.0.3.0 Unquoted Service Path Privilege Escalation
High 7.8
In plain English
A high-severity security flaw in Chromacam from Personifyinc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placing malicious executables in unquoted path directories. Attackers with write access to C:\ or subdirectories like C:\Program Files (x86)\Personify\ can place a malicious Program.exe or PsyFrameGrabberService.exe file that executes with LocalSystem privileges when the service starts automatically at boot.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Personifyinc | Chromacam | 4.0.3.0 |
Weakness: CWE-428 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51210 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Chromacam 4.0.3.0 Unquoted Service Path Privilege Escalation third-party-advisory