CVE-2019-25275
Published: 05 February 2026
Summary
CVE-2019-25275 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Filehorse (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25275 is an unquoted service path vulnerability in BartVPN version 1.2.2, specifically affecting the BartVPNService component. This issue, mapped to CWE-428, arises from an unquoted binary path in the service configuration, enabling local attackers to potentially execute arbitrary code with elevated system privileges. Attackers exploit it by placing malicious executables in specific file system locations that the Windows service manager searches prior to the legitimate path, thereby hijacking the service's execution context. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-05.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N). Upon successful exploitation, the attacker gains the ability to execute arbitrary code under the elevated privileges of the BartVPNService, typically SYSTEM level, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). This could lead to full system compromise on affected Windows hosts running the vulnerable BartVPN installation.
Advisories and references, including an exploit demonstration at https://www.exploit-db.com/exploits/47675 and a detailed write-up from Vulncheck at https://www.vulncheck.com/advisories/bartvpn-bartvpnservice-unquoted-service-path, provide technical details on the flaw and exploitation methods. Additional context appears at https://www.filehorse.com/. Practitioners should consult these for vendor-specific guidance on patches or workarounds, as no mitigation details are specified in the core CVE data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19392
Vulnerability details
BartVPN 1.2.2 contains an unquoted service path vulnerability in the BartVPNService that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific file system locations…
more
to hijack the service's execution context.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in BartVPNService directly enables path interception by unquoted path (T1574.009) for local privilege escalation to SYSTEM via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of the unquoted service path flaw in BartVPNService to prevent local privilege escalation.
Mandates secure configuration settings for system components like services, including quoted binary paths to block hijacking via Windows service manager search order.
Enforces least privilege for service accounts, limiting the impact of hijacked execution even if the unquoted path vulnerability is exploited.