Local privilege escalation via unquoted startup path

Unquoted search path in Schneider Electric Easergy Studio 9.3.3 and earlier allows local users to gain elevated privileges. A privileged startup path omits quotation marks, so Windows can resolve an attacker-planted executable instead of the intended trusted file. A valid local account, write access to the searched location, and a system reboot are required; successful exploitation executes attacker code with elevated rights.