CVE-2019-25283
Published: 05 February 2026
Summary
CVE-2019-25283 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Shrew Soft VPN (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25283 is an unquoted service path vulnerability affecting Shrew Soft VPN Client version 2.2.2. The flaw enables local users to execute arbitrary code with elevated system privileges by placing malicious executables in the unquoted service path, which is exploited during service startup or system reboot. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H) and maps to CWE-428 (Unquoted Search Path or Element).
The vulnerability can be exploited by local attackers who already possess low-privilege user access on the target system. By leveraging the unquoted service path, they can position a malicious executable to run with SYSTEM-level privileges upon service initiation or reboot, resulting in high impacts to confidentiality, integrity, and availability.
Advisories and related resources include an Exploit-DB entry at https://www.exploit-db.com/exploits/47660, the vendor site at https://www.shrew.net, and a VulnCheck advisory at https://www.vulncheck.com/advisories/shrew-soft-vpn-client-iked-unquoted-service-path, which may detail patches or mitigation steps. A public exploit is documented on Exploit-DB, highlighting the risk of practical exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19389
Vulnerability details
Shrew Soft VPN Client 2.2.2 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can place malicious executables in the unquoted service path to gain elevated access during service startup…
more
or system reboot.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path abuse enabling local privilege escalation via malicious executable placement in service startup.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring timely remediation of the unquoted service path flaw through patching or vendor-provided fixes.
Enforces secure configuration settings for services, including quoted paths and restricted executable locations, to prevent exploitation of unquoted service paths.
Limits low-privilege local user access to directories in service search paths, blocking placement of malicious executables for privilege escalation.