CVE-2019-25285
Published: 05 February 2026
Summary
CVE-2019-25285 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Alps Pointing-device Controller (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2019-25285 is an unquoted service path vulnerability in the ApHidMonitorService component of the Alps Pointing-device Controller version 8.1202.1711.04. This issue, mapped to CWE-428, allows local attackers to execute arbitrary code with elevated privileges by exploiting the improperly quoted service binary path in the Windows registry. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability for local systems.
A low-privileged local attacker can exploit this vulnerability by placing a malicious executable in a directory along the service's unquoted path, such as within a parent folder of the legitimate service binary. When the ApHidMonitorService restarts—either manually, via system reboot, or through normal operation—the Windows Service Control Manager executes the attacker's file with SYSTEM-level privileges instead of the intended binary, resulting in full system compromise.
Advisories and references highlight the issue without specifying patches; the vendor site (alps.com) is listed, alongside a VulnCheck advisory detailing the ApHidMonitorService unquoted path and an Exploit-DB entry (47637) providing a public proof-of-concept exploit. Security practitioners should verify service paths via tools like sc query and authorize.exe, and consider removing or updating the affected driver where possible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19385
Vulnerability details
Alps Pointing-device Controller 8.1202.1711.04 contains an unquoted service path vulnerability in the ApHidMonitorService that allows local attackers to execute code with elevated privileges. Attackers can place a malicious executable in the service path and gain system-level access when the service…
more
restarts or the system reboots.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception for local privilege escalation to SYSTEM via malicious binary placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates secure configuration settings including properly quoted executable paths for Windows services to directly prevent exploitation of unquoted service path vulnerabilities like CVE-2019-25285.
Requires timely identification, reporting, and correction of flaws such as the unquoted service path in ApHidMonitorService through patches or registry fixes.
Enables periodic vulnerability scanning to identify unquoted service path issues in system services like ApHidMonitorService using tools that query service configurations.