CVE-2019-25286
Published: 05 February 2026
Summary
CVE-2019-25286 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Gcafe (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2019-25286 is an unquoted service path vulnerability affecting GCafé 3.0, specifically in the gbClientService component. This flaw, classified under CWE-428, arises from an improperly quoted executable path in the service configuration, enabling local attackers to potentially execute arbitrary code with elevated privileges. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
Local attackers with low privileges on a vulnerable system can exploit this issue by placing a malicious executable in a directory preceding the legitimate service binary in the system's search path. When the gbClientService starts or restarts, the system executes the attacker's malicious file instead, running it with LocalSystem permissions and granting full administrative control over the host.
References include the vendor site at https://gcafe.vn/, a proof-of-concept exploit at https://www.exploit-db.com/exploits/47604, and an advisory from VulnCheck at https://www.vulncheck.com/advisories/gcafe-gbclienservice-unquoted-service-path detailing the unquoted service path issue. No specific patch or mitigation details are outlined in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19390
Vulnerability details
GCafé 3.0 contains an unquoted service path vulnerability in the gbClientService that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be…
more
run with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in gbClientService directly enables path interception by unquoted path (T1574.009) for local privilege escalation to LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates establishment and implementation of secure configuration settings for services, including properly quoted executable paths to prevent hijacking by malicious files in preceding search path directories.
Requires identification, reporting, and correction of system flaws such as unquoted service paths to eliminate the vulnerability enabling local privilege escalation.
Conducts vulnerability scanning that specifically identifies unquoted service path issues, enabling detection and subsequent remediation to mitigate the exploit.