CVE-2019-25272

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

TexasSoft CyberPlanet 6.4.131 is affected by CVE-2019-25272, an unquoted service path vulnerability in the CCSrvProxy service. The issue stems from the service binary path 'C:\Program Files (x86)\TenaxSoft\CyberPlanet\SrvProxy.exe', which lacks proper quoting, enabling local attackers to execute arbitrary code. This flaw is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-428 (Unquoted Search Path or Element).

Local attackers with low privileges can exploit this vulnerability by placing a malicious executable in one of the search path directories preceding the intended service binary location, such as C:\Program Files (x86)\TenaxSoft\CyberPlanet\. When the CCSrvProxy service starts or restarts, it executes the attacker's malicious file instead, allowing elevation to system privileges and full control over the affected system, including high confidentiality, integrity, and availability impacts.

Advisories and related resources, including a VulnCheck advisory on the TexasSoft CyberPlanet CCSrvProxy unquoted service path, an Exploit-DB entry (47724) detailing a proof-of-concept, and the vendor site at tenaxsoft.com, provide further technical details on the issue, though specific patch information is not detailed in the CVE description. Security practitioners should verify service configurations and apply any available updates from the vendor.