CVE-2019-25267

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Wing FTP Server 6.0.7 is affected by CVE-2019-25267, an unquoted service path vulnerability classified under CWE-428. This flaw arises from an unquoted binary path in the Windows service configuration, enabling local attackers to potentially execute arbitrary code with elevated system privileges. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.

Local low-privileged users (PR:L) can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's PATH search order. When the Wing FTP Server service starts or restarts, Windows will execute the attacker's binary instead due to the unquoted path, granting it LocalSystem permissions and allowing full system compromise.

Advisories from VulnCheck and Exploit-DB provide further details, including a proof-of-concept exploit at https://www.exploit-db.com/exploits/47818. Security practitioners should consult the vendor's site at https://www.wftpserver.com/ for patches or updates, and apply standard mitigations such as quoting the service ImagePath registry value or restricting write access to service directories.

A public exploit is available on Exploit-DB, indicating potential for real-world local privilege escalation attacks on unpatched systems running the affected version.