CVE-2019-25274
Published: 05 February 2026
Summary
CVE-2019-25274 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Photodex (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and CM-7 (Least Functionality).
Deeper analysis
CVE-2019-25274 is an unquoted service path vulnerability in ProShow Producer version 9.0.3797, specifically affecting the ScsiAccess service. The issue stems from an unquoted binary path, which enables local attackers to potentially execute arbitrary code by injecting malicious executables that the service attempts to launch during startup.
The vulnerability can be exploited by local attackers who have low privileges on the system, as indicated by the CVSS v3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.8. Successful exploitation allows the attacker to place a malicious executable in a directory parsed by the unquoted path, resulting in execution with LocalSystem privileges when the service starts, thereby granting high-impact control over confidentiality, integrity, and availability.
Advisories and references include the Photodex vendor site at http://www.photodex.com/, an Exploit-DB entry at https://www.exploit-db.com/exploits/47705 detailing a proof-of-concept exploit, and a VulnCheck advisory at https://www.vulncheck.com/advisories/proshow-producer-unquoted-service-path, which further describes the unquoted service path issue in ProShow Producer. No specific patch or mitigation details are provided in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19391
Vulnerability details
ProShow Producer 9.0.3797 contains an unquoted service path vulnerability in the ScsiAccess service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges…
more
during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service directly enables T1574.009 Path Interception by Unquoted Path for local privilege escalation to SYSTEM.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
CM-6 enforces secure configuration settings for services, directly preventing exploitation by requiring properly quoted binary paths and restricted write access to service directories.
CM-7 implements least functionality by disabling or restricting unnecessary services like ScsiAccess, eliminating the vulnerable service startup entirely.
AC-6 applies least privilege to services, reducing the impact of unquoted path exploitation by configuring ScsiAccess to run under a low-privilege account rather than LocalSystem.