CVE-2019-25273
Published: 05 February 2026
Summary
CVE-2019-25273 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Easy Hide Ip (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2019-25273 is an unquoted service path vulnerability affecting Easy-Hide-IP version 5.0.0.3, specifically in the EasyRedirect service. The service binary is installed at 'C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe', but the service configuration lacks quotes around the path, enabling exploitation as defined by CWE-428. This flaw has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from local access.
Local attackers with low privileges can exploit this vulnerability by placing a malicious executable in one of the intermediate directories along the unquoted path (such as C:\Program Files\ or subfolders), which the Windows service control manager will execute instead of the legitimate binary upon service startup or restart. Successful exploitation allows arbitrary code execution, potentially leading to full privilege escalation on the affected system.
Advisories from VulnCheck and a proof-of-concept exploit on Exploit-DB (ID 47712) document the issue, with the vendor site at easy-hide-ip.com available for additional context. Specific mitigation details, such as patching the service path or updating the software, are referenced in these sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19393
Vulnerability details
Easy-Hide-IP 5.0.0.3 contains an unquoted service path vulnerability in the EasyRedirect service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe' to inject malicious executables and escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly matches Path Interception by Unquoted Path (T1574.009); enables local privilege escalation via malicious binary placement (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identifying, reporting, and correcting the unquoted service path flaw in CVE-2019-25273 to prevent arbitrary code execution and privilege escalation.
Mandates secure configuration settings including quoted executable paths for Windows services to eliminate the unquoted path vulnerability exploited in this CVE.
Enforces software usage restrictions via whitelisting to block execution of malicious binaries placed in intermediate directories along the unquoted service path.