CVE-2019-25292
Published: 06 February 2026
Summary
CVE-2019-25292 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Alps HID Monitor (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2019-25292 is an unquoted service path vulnerability affecting Alps HID Monitor Service version 8.1.0.10. The flaw resides in the service path for HidMonitorSvc.exe, located at C:\Program Files\Apoint2K\HidMonitorSvc.exe, and is classified under CWE-428. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H), indicating high impact potential from local access.
Local attackers with low privileges can exploit this vulnerability by placing a malicious executable in an intermediate directory exploited by the unquoted path traversal. Successful exploitation enables execution of arbitrary code with elevated privileges, leading to system-level access and high confidentiality, integrity, and availability impacts.
Advisories from VulnCheck detail the unquoted service path issue in AphidMonitorService, while an Exploit-DB entry (47605) provides a proof-of-concept exploit. Additional guidance is available from the vendor at alps.com/e/. Practitioners should consult these references for patching instructions or service configuration corrections to mitigate the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19405
Vulnerability details
Alps HID Monitor Service 8.1.0.10 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files\Apoint2K\HidMonitorSvc.exe to inject malicious executables and gain system-level access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path exploitation enabling binary hijack for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and correction of the unquoted service path flaw to prevent local privilege escalation via malicious executable execution.
Mandates establishment and enforcement of secure configuration settings for services, including quoted paths to block path hijacking exploits like this CVE.
Ensures baseline configurations include properly quoted service paths, preventing deployment of vulnerable service configurations exploited by this CVE.