CVE-2019-25276
Published: 05 February 2026
Summary
CVE-2019-25276 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Rockwellautomation (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2019-25276 is an unquoted service path vulnerability affecting Studio 5000 Logix Designer version 30.01.00, specifically in the FactoryTalk Activation Service. The issue arises from an unquoted path at C:\Program Files (x86)\Rockwell Software\FactoryTalk Activation\, classified under CWE-428, which enables local users to potentially execute arbitrary code with elevated privileges, as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local low-privileged users can exploit this vulnerability by injecting a malicious executable into a directory that the service resolves during startup or operation, due to the lack of quotes around the path. Successful exploitation allows attackers to execute code with LocalSystem permissions, granting high-impact confidentiality, integrity, and availability compromises on the affected system.
Advisories and resources, including a Vulncheck advisory on the Studio Logix Designer FactoryTalk Activation Service unquoted service path, an Exploit-DB entry (47676), and Rockwell Automation's overview page, provide details on the vulnerability and exploitation. Specific mitigation steps, such as patching or service configuration changes, are referenced in these sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19388
Vulnerability details
Studio 5000 Logix Designer 30.01.00 contains an unquoted service path vulnerability in the FactoryTalk Activation Service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Rockwell Software\FactoryTalk Activation\ to…
more
inject malicious code that would execute with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in FactoryTalk Activation Service directly enables path interception by unquoted path for local privilege escalation to LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path vulnerability through timely patching or flaw correction as specified by the vendor.
Enforces secure configuration settings for services, including quoted executable paths to prevent resolution to exploitable subdirectories.
Prohibits and blocks execution of unauthorized user-placed executables that exploit the unquoted service path for privilege escalation.