CVE-2019-25292

HighPublic PoC

Published: 06 February 2026

Published

06 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0001 0.5th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25292 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Alps HID Monitor (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires identification, reporting, and correction of the unquoted service path flaw to prevent local privilege escalation via malicious executable execution.

CM-6 Configuration Settings good match

prevent

Mandates establishment and enforcement of secure configuration settings for services, including quoted paths to block path hijacking exploits like this CVE.

CM-2 Baseline Configuration good match

prevent

Ensures baseline configurations include properly quoted service paths, preventing deployment of vulnerable service configurations exploited by this CVE.

NVD Description

Alps HID Monitor Service 8.1.0.10 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files\Apoint2K\HidMonitorSvc.exe to inject malicious executables and gain system-level access.

Deeper analysisAI

CVE-2019-25292 is an unquoted service path vulnerability affecting Alps HID Monitor Service version 8.1.0.10. The flaw resides in the service path for HidMonitorSvc.exe, located at C:\Program Files\Apoint2K\HidMonitorSvc.exe, and is classified under CWE-428. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H), indicating high impact potential from local access.

Local attackers with low privileges can exploit this vulnerability by placing a malicious executable in an intermediate directory exploited by the unquoted path traversal. Successful exploitation enables execution of arbitrary code with elevated privileges, leading to system-level access and high confidentiality, integrity, and availability impacts.

Advisories from VulnCheck detail the unquoted service path issue in AphidMonitorService, while an Exploit-DB entry (47605) provides a proof-of-concept exploit. Additional guidance is available from the vendor at alps.com/e/. Practitioners should consult these references for patching instructions or service configuration corrections to mitigate the vulnerability.