CVE-2019-25272
Published: 05 February 2026
Summary
CVE-2019-25272 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Tenaxsoft (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).
Deeper analysis
TexasSoft CyberPlanet 6.4.131 is affected by CVE-2019-25272, an unquoted service path vulnerability in the CCSrvProxy service. The issue stems from the service binary path 'C:\Program Files (x86)\TenaxSoft\CyberPlanet\SrvProxy.exe', which lacks proper quoting, enabling local attackers to execute arbitrary code. This flaw is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-428 (Unquoted Search Path or Element).
Local attackers with low privileges can exploit this vulnerability by placing a malicious executable in one of the search path directories preceding the intended service binary location, such as C:\Program Files (x86)\TenaxSoft\CyberPlanet\. When the CCSrvProxy service starts or restarts, it executes the attacker's malicious file instead, allowing elevation to system privileges and full control over the affected system, including high confidentiality, integrity, and availability impacts.
Advisories and related resources, including a VulnCheck advisory on the TexasSoft CyberPlanet CCSrvProxy unquoted service path, an Exploit-DB entry (47724) detailing a proof-of-concept, and the vendor site at tenaxsoft.com, provide further technical details on the issue, though specific patch information is not detailed in the CVE description. Security practitioners should verify service configurations and apply any available updates from the vendor.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19394
Vulnerability details
TexasSoft CyberPlanet 6.4.131 contains an unquoted service path vulnerability in the CCSrvProxy service that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\TenaxSoft\CyberPlanet\SrvProxy.exe' to inject malicious executables and gain elevated system privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in CCSrvProxy directly enables path interception for arbitrary code execution and local privilege escalation to SYSTEM.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for services, including proper quoting of executable paths to prevent exploitation of unquoted service paths.
Requires identification, reporting, and timely remediation of flaws like unquoted service paths to eliminate the vulnerability before exploitation.
Develops and maintains baseline configurations that specify correctly quoted service paths, preventing deployment or operation with vulnerable settings.