Cyber Resilience

CVE-2019-25269

HighPublic PoC

Published: 05 February 2026

Published
05 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0033 24.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25269 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Netgate (inferred from references). Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 24.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25269 is an unquoted service path vulnerability in Amiti Antivirus version 25.0.640, specifically within its Windows service configurations. This flaw, classified under CWE-428, arises from service binaries not being enclosed in quotes, allowing the Windows service control manager to interpret spaces in paths as delimiters and search preceding directories for executables.

Local attackers with low privileges can exploit this vulnerability, as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). By placing malicious executable files in specific directories that the service path traverses before reaching the legitimate binary, an attacker can hijack service execution. This results in arbitrary code running with elevated LocalSystem privileges, enabling high-impact confidentiality, integrity, and availability compromises on the affected system.

Advisories and references, including those from VulnCheck at https://www.vulncheck.com/advisories/amiti-antivirus-unquoted-service-path-vulnerability and an exploit proof-of-concept at https://www.exploit-db.com/exploits/47747, document the vulnerability details. Additional resources are available at http://www.netgate.sk/. No specific patch or mitigation guidance is detailed in the provided CVE information.

EU & UK References

Vulnerability details

Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges by placing executable files in specific directory locations.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1574.009 Path Interception by Unquoted Path Stealth
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Why these techniques?

Unquoted service path directly enables path interception by unquoted path (T1574.009) for service hijacking and privilege escalation to LocalSystem.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-36928Shared CWE-428
CVE-2023-54336Shared CWE-428
CVE-2020-37048Shared CWE-428
CVE-2019-25306Shared CWE-428
CVE-2020-36979Shared CWE-428
CVE-2020-36929Shared CWE-428
CVE-2020-37017Shared CWE-428
CVE-2021-47859Shared CWE-428
CVE-2019-25309Shared CWE-428
CVE-2021-47790Shared CWE-428

Affected Assets

Netgate
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Mandates secure configuration settings for services, including quoted paths, directly preventing unquoted service path hijacking exploits.

prevent

Requires identification and timely remediation of flaws like unquoted service paths in software such as Amiti Antivirus.

detect

Vulnerability scanning identifies unquoted service path misconfigurations, enabling detection of this specific CVE.

References