CVE-2019-25281
Published: 05 February 2026
Summary
CVE-2019-25281 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Ncp E (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2019-25281 is an unquoted service path vulnerability affecting NCP Secure Entry Client version 9.2 on Windows systems. The flaw exists in multiple services, including ncprwsnt, rwsrsu, ncpclcfg, and NcpSec, where the service executable paths are not properly quoted, allowing local privilege escalation. This issue corresponds to CWE-428 (Unquoted Search Path or Element) and has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local users with low privileges can exploit this vulnerability by placing malicious executables in specific directories that the Windows service manager searches before locating the legitimate service binaries. Upon service startup, the injected malicious code executes with LocalSystem privileges, potentially granting attackers full control over the system, including high confidentiality, integrity, and availability impacts.
Advisories such as the VulnCheck report detail the unquoted paths and exploitation vectors, while a proof-of-concept exploit is publicly available on Exploit-DB (ID 47668). The NCP vendor site provides additional resources, though specific patch details are not outlined in the provided references. Security practitioners should verify service configurations and apply updates from the vendor to mitigate exposure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19384
Vulnerability details
NCP Secure Entry Client 9.2 contains an unquoted service path vulnerability in multiple Windows services that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted paths in services like ncprwsnt, rwsrsu, ncpclcfg, and NcpSec to inject…
more
malicious code that would execute with LocalSystem privileges during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path (T1574.009) for local privilege escalation (T1068) via malicious executable placement in service search directories.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for services, ensuring executable paths are properly quoted to block malicious code execution during service startup.
Requires identification, reporting, and correction of software flaws like unquoted service paths, enabling timely patching to eliminate the vulnerability.
Vulnerability monitoring and scanning identifies unquoted service path vulnerabilities in services like ncprwsnt and NcpSec for prompt remediation.