Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path
Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path
AI Analysis
Technical Summary
This vulnerability is an unquoted service path in the 'DAService' Windows service of Lenovo LegionSpace 1.7.11.2. Because the service binary path contains spaces and is not enclosed in quotes, Windows may incorrectly interpret the path and execute a malicious executable placed by a local attacker in a path segment before the legitimate executable. The service runs with LocalSystem privileges and starts automatically, so exploitation could lead to arbitrary code execution with elevated privileges. The vendor was notified on 2025-12-04 and released a fixed version 1.8.12.13 on 2026-02-09. Public exploit code is available in text format.
Potential Impact
A local attacker with the ability to write to certain directories in the file system could exploit this vulnerability to execute arbitrary code with the elevated privileges of the DAService, which runs as LocalSystem. This could result in full system compromise under the context of the highest privilege level on the affected machine. Exploitation requires local access and the ability to place malicious executables in specific path locations.
Mitigation Recommendations
Upgrade Lenovo LegionSpace to version 1.8.12.13 or later, as provided by the vendor. This official fix addresses the unquoted service path vulnerability. No other mitigation actions are indicated by the vendor advisory.
Indicators of Compromise
- exploit-code: # Exploit Title: Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path # Exploit Author: CENACIF-MX # Discovery Date: 2025-12-04 # Vendor Homepage: https://support.lenovo.com/es/es/solutions/legion_space # Tested Version: 1.7.11.2 # Vulnerability Type: Unquoted Service Path # Tested on OS: Microsoft Windows 11 Enterprise x64 es # Fix: Upgrade to Lenovo LegionSpace 1.8.12.13 or later # CVE : N/A # Disclosure Timeline # | Date | Event | # |------|-------| # | 2025-12-04 | Vulnerability discovered | # | 2025-12-04 | Vendor notified | # | 2026-02-09 | New version | # Step to discover Unquoted Service Path: C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Lenovo" | findstr /i /v """ DAService DAService C:\Program Files\Lenovo\LegionSpace\1.7.11.2\LSDaemon.exe Auto # Service info: C:\>sc qc "DAService" [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO: DAService TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START CONTROL_ERROR : 1 NORMAL NOMBRE_RUTA_BINARIO: C:\Program Files\Lenovo\LegionSpace\1.7.11.2\LSDaemon.exe GRUPO_ORDEN_CARGA : ETIQUETA : 0 NOMBRE_MOSTRAR : DAService DEPENDENCIAS : NOMBRE_INICIO_SERVICIO: LocalSystem #Exploit: A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path
Description
Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is an unquoted service path in the 'DAService' Windows service of Lenovo LegionSpace 1.7.11.2. Because the service binary path contains spaces and is not enclosed in quotes, Windows may incorrectly interpret the path and execute a malicious executable placed by a local attacker in a path segment before the legitimate executable. The service runs with LocalSystem privileges and starts automatically, so exploitation could lead to arbitrary code execution with elevated privileges. The vendor was notified on 2025-12-04 and released a fixed version 1.8.12.13 on 2026-02-09. Public exploit code is available in text format.
Potential Impact
A local attacker with the ability to write to certain directories in the file system could exploit this vulnerability to execute arbitrary code with the elevated privileges of the DAService, which runs as LocalSystem. This could result in full system compromise under the context of the highest privilege level on the affected machine. Exploitation requires local access and the ability to place malicious executables in specific path locations.
Mitigation Recommendations
Upgrade Lenovo LegionSpace to version 1.8.12.13 or later, as provided by the vendor. This official fix addresses the unquoted service path vulnerability. No other mitigation actions are indicated by the vendor advisory.
Technical Details
- Edb Id
- 52570
- Has Exploit Code
- true
- Code Language
- text
Indicators of Compromise
Exploit Source Code
Exploit code for Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path
# Exploit Title: Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path # Exploit Author: CENACIF-MX # Discovery Date: 2025-12-04 # Vendor Homepage: https://support.lenovo.com/es/es/solutions/legion_space # Tested Version: 1.7.11.2 # Vulnerability Type: Unquoted Service Path # Tested on OS: Microsoft Windows 11 Enterprise x64 es # Fix: Upgrade to Lenovo LegionSpace 1.8.12.13 or later # CVE : N/A # Disclosure Timeline # | Date | Event | # |------|-------| # | 2025-12-04 | Vulnerability d... (1220 more characters)
Threat ID: 6a0f29ffe1370fbb48ed2e94
Added to database: 05/21/2026, 15:51:27 UTC
Last enriched: 06/16/2026, 09:28:34 UTC
Last updated: 07/29/2026, 19:28:29 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.