CVE-2019-25269
Published: 05 February 2026
Summary
CVE-2019-25269 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Netgate (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 24.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25269 is an unquoted service path vulnerability in Amiti Antivirus version 25.0.640, specifically within its Windows service configurations. This flaw, classified under CWE-428, arises from service binaries not being enclosed in quotes, allowing the Windows service control manager to interpret spaces in paths as delimiters and search preceding directories for executables.
Local attackers with low privileges can exploit this vulnerability, as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). By placing malicious executable files in specific directories that the service path traverses before reaching the legitimate binary, an attacker can hijack service execution. This results in arbitrary code running with elevated LocalSystem privileges, enabling high-impact confidentiality, integrity, and availability compromises on the affected system.
Advisories and references, including those from VulnCheck at https://www.vulncheck.com/advisories/amiti-antivirus-unquoted-service-path-vulnerability and an exploit proof-of-concept at https://www.exploit-db.com/exploits/47747, document the vulnerability details. Additional resources are available at http://www.netgate.sk/. No specific patch or mitigation guidance is detailed in the provided CVE information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19396
Vulnerability details
Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges by placing executable files in specific directory locations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception by unquoted path (T1574.009) for service hijacking and privilege escalation to LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates secure configuration settings for services, including quoted paths, directly preventing unquoted service path hijacking exploits.
Requires identification and timely remediation of flaws like unquoted service paths in software such as Amiti Antivirus.
Vulnerability scanning identifies unquoted service path misconfigurations, enabling detection of this specific CVE.