CVE-2019-25304
Published: 06 February 2026
Summary
CVE-2019-25304 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Issivs (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25304 is an unquoted service path vulnerability (CWE-428) affecting SecurOS Enterprise 10.2, specifically in the SecurosCtrlService. The flaw stems from an unquoted path in the service configuration under C:\Program Files (x86)\ISS\SecurOS\, which allows local users to potentially execute arbitrary code with elevated privileges. This issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts from local exploitation.
Local users with low privileges can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's PATH resolution during service startup. When SecurosCtrlService starts, the system executes the attacker's binary instead, granting it system-level permissions and enabling full control over the affected host, including potential persistence, data exfiltration, or further lateral movement.
Advisories and references, including a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/47556) and a detailed analysis from VulnCheck (https://www.vulncheck.com/advisories/intelligent-security-system-securos-enterprise-securosctrlservice-unquoted-service-path), document the issue; practitioners should review the vendor's SecurOS Enterprise product page (https://www.issivs.com/product-detail/secure-os-enterprise/) for patching guidance or service reconfiguration to quote the path properly. A public PoC availability heightens the risk for unpatched installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19406
Vulnerability details
SecurOS Enterprise 10.2 contains an unquoted service path vulnerability in the SecurosCtrlService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\ISS\SecurOS\ to insert malicious code that would execute…
more
with system-level permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in SecurosCtrlService directly enables path interception by placing a malicious binary earlier in PATH resolution, hijacking service execution for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for services, including properly quoting paths in registry ImagePath values to eliminate unquoted service path vulnerabilities.
Requires timely identification, reporting, and remediation of flaws like CVE-2019-25304 through patching or service reconfiguration as advised by the vendor.
Enforces least privilege to restrict low-privileged local users from writing malicious executables to exploitable directories in the service path resolution order.