CVE-2024-58288 is an unquoted service path vulnerability affecting Genexus Protection Server 9.7.2.10. The vulnerability exists in the Windows service configuration for protsrvservice, where the binary path is not enclosed in quotes. This misconfiguration can be exploited by attackers to execute arbitrary code with LocalSystem privileges by placing malicious executables in directories that are parsed by the service path. This type of vulnerability is categorized as CWE-428. The CVSS 4.0 base score is 8.7, indicating a high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary code with elevated LocalSystem privileges on the affected system. This can lead to full system compromise, including unauthorized access, data modification, and disruption of service. The vulnerability affects the confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to manually verify and correct the service path configuration by enclosing the binary path in quotes to prevent exploitation. Avoid placing untrusted executables in directories referenced by the service path.