This vulnerability (CWE-427) in PowerAttendant Standard Edition involves an uncontrolled search path element where the application loads DLLs from its installation directory without sufficient permission controls. An attacker with local access can place a malicious DLL in this directory, which the service may load and execute with elevated privileges during startup. This can lead to complete compromise of the system running the vulnerable version (2.1.2 or lower). The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, requiring local attack complexity and privileges but no user interaction.

Successful exploitation allows an attacker with local access to execute arbitrary code with administrator privileges on the affected system. This can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data and disruption of service. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the installation directory to trusted users only and monitor for unauthorized file modifications. Avoid running the service on systems where untrusted users have local access.