CVE-2019-25288
Published: 05 February 2026
Summary
CVE-2019-25288 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wacom WTabletService (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2019-25288 is an unquoted service path vulnerability in Wacom WTabletService version 6.6.7-3. This flaw occurs when the Windows service executable path is not properly quoted, allowing local attackers to hijack the service by placing a malicious executable in a directory preceding the legitimate service binary in the system's search path.
Local attackers with low privileges can exploit this vulnerability by inserting a malicious executable file into the service path. Upon service restart or system reboot, the malicious code executes with elevated privileges, potentially granting high-impact confidentiality, integrity, and availability compromises as scored by CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base score 7.8). The issue maps to CWE-428 (Unquoted Search Path or Element).
Advisories and references, including an Exploit-DB entry (exploit 47593) providing proof-of-concept code, a VulnCheck advisory detailing the unquoted service path in WTabletService and WTabletServicePro, and the Wacom vendor site, highlight the vulnerability but do not specify patches in the available information. Security practitioners should verify service paths and apply any vendor updates from Wacom.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19387
Vulnerability details
Wacom WTabletService 6.6.7-3 contains an unquoted service path vulnerability that allows local attackers to execute malicious code with elevated privileges. Attackers can insert an executable file in the service path to run unauthorized code when the service restarts or the…
more
system reboots.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables service path hijacking via unquoted executable path for local privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and correction of system flaws such as the unquoted service path vulnerability in Wacom WTabletService to prevent exploitation.
Mandates establishment and enforcement of secure configuration settings for services, including properly quoted executable paths to block hijacking via unquoted paths.
Provides for regular vulnerability scanning that identifies configuration weaknesses like unquoted service paths in CVE-2019-25288 for timely remediation.