CVE-2019-25281
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2019-25281 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Ncp E (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25281 is an unquoted service path vulnerability affecting NCP Secure Entry Client version 9.2 on Windows systems. The flaw exists in multiple services, including ncprwsnt, rwsrsu, ncpclcfg, and NcpSec, where the service executable paths are not properly quoted, allowing local privilege escalation. This issue corresponds to CWE-428 (Unquoted Search Path or Element) and has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local users with low privileges can exploit this vulnerability by placing malicious executables in specific directories that the Windows service manager searches before locating the legitimate service binaries. Upon service startup, the injected malicious code executes with LocalSystem privileges, potentially granting attackers full control over the system, including high confidentiality, integrity, and availability impacts.
Advisories such as the VulnCheck report detail the unquoted paths and exploitation vectors, while a proof-of-concept exploit is publicly available on Exploit-DB (ID 47668). The NCP vendor site provides additional resources, though specific patch details are not outlined in the provided references. Security practitioners should verify service configurations and apply updates from the vendor to mitigate exposure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19384
Vulnerability Data
NCP Secure Entry Client 9.2 contains an unquoted service path vulnerability in multiple Windows services that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted paths in services like ncprwsnt, rwsrsu, ncpclcfg, and NcpSec to inject…
more
malicious code that would execute with LocalSystem privileges during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path (T1574.009) for local privilege escalation (T1068) via malicious executable placement in service search directories.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for services, ensuring executable paths are properly quoted to block malicious code execution during service startup.
Requires identification, reporting, and correction of software flaws like unquoted service paths, enabling timely patching to eliminate the vulnerability.
Vulnerability monitoring and scanning identifies unquoted service path vulnerabilities in services like ncprwsnt and NcpSec for prompt remediation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent path-handling flaws such as unquoted elements during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect unquoted search-path issues before deployment.
Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.
Secure development lifecycle practices include input validation and path handling that reduce unquoted search-path weaknesses.
Secure system architecture and engineering principles require safe path construction and quoting conventions.
Secure coding standards directly mandate quoting search paths and avoiding unsafe path construction.
Change-management processes can enforce review of path-handling changes that might introduce unquoted elements.