CVE-2019-25276

HighPublic PoC

Published: 05 February 2026

Published

05 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0000 0.0th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25276 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Rockwellautomation (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, ranked at the 0.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and CM-6 (Configuration Settings).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the unquoted service path vulnerability through timely patching or flaw correction as specified by the vendor.

CM-6 Configuration Settings good match

prevent

Enforces secure configuration settings for services, including quoted executable paths to prevent resolution to exploitable subdirectories.

CM-11 User-installed Software good match

prevent

Prohibits and blocks execution of unauthorized user-placed executables that exploit the unquoted service path for privilege escalation.

NVD Description

Studio 5000 Logix Designer 30.01.00 contains an unquoted service path vulnerability in the FactoryTalk Activation Service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Rockwell Software\FactoryTalk Activation\ to…

inject malicious code that would execute with LocalSystem permissions.

Deeper analysisAI

CVE-2019-25276 is an unquoted service path vulnerability affecting Studio 5000 Logix Designer version 30.01.00, specifically in the FactoryTalk Activation Service. The issue arises from an unquoted path at C:\Program Files (x86)\Rockwell Software\FactoryTalk Activation\, classified under CWE-428, which enables local users to potentially execute arbitrary code with elevated privileges, as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Local low-privileged users can exploit this vulnerability by injecting a malicious executable into a directory that the service resolves during startup or operation, due to the lack of quotes around the path. Successful exploitation allows attackers to execute code with LocalSystem permissions, granting high-impact confidentiality, integrity, and availability compromises on the affected system.

Advisories and resources, including a Vulncheck advisory on the Studio Logix Designer FactoryTalk Activation Service unquoted service path, an Exploit-DB entry (47676), and Rockwell Automation's overview page, provide details on the vulnerability and exploitation. Specific mitigation steps, such as patching or service configuration changes, are referenced in these sources.