CVE-2019-25273
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2019-25273 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Easy Hide Ip (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25273 is an unquoted service path vulnerability affecting Easy-Hide-IP version 5.0.0.3, specifically in the EasyRedirect service. The service binary is installed at 'C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe', but the service configuration lacks quotes around the path, enabling exploitation as defined by CWE-428. This flaw has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from local access.
Local attackers with low privileges can exploit this vulnerability by placing a malicious executable in one of the intermediate directories along the unquoted path (such as C:\Program Files\ or subfolders), which the Windows service control manager will execute instead of the legitimate binary upon service startup or restart. Successful exploitation allows arbitrary code execution, potentially leading to full privilege escalation on the affected system.
Advisories from VulnCheck and a proof-of-concept exploit on Exploit-DB (ID 47712) document the issue, with the vendor site at easy-hide-ip.com available for additional context. Specific mitigation details, such as patching the service path or updating the software, are referenced in these sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19393
Vulnerability Data
Easy-Hide-IP 5.0.0.3 contains an unquoted service path vulnerability in the EasyRedirect service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe' to inject malicious executables and escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly matches Path Interception by Unquoted Path (T1574.009); enables local privilege escalation via malicious binary placement (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identifying, reporting, and correcting the unquoted service path flaw in CVE-2019-25273 to prevent arbitrary code execution and privilege escalation.
Mandates secure configuration settings including quoted executable paths for Windows services to eliminate the unquoted path vulnerability exploited in this CVE.
Enforces software usage restrictions via whitelisting to block execution of malicious binaries placed in intermediate directories along the unquoted service path.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent path-handling flaws such as unquoted elements during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect unquoted search-path issues before deployment.
Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.
Secure development lifecycle practices include input validation and path handling that reduce unquoted search-path weaknesses.
Secure system architecture and engineering principles require safe path construction and quoting conventions.
Secure coding standards directly mandate quoting search paths and avoiding unsafe path construction.
Change-management processes can enforce review of path-handling changes that might introduce unquoted elements.