Cyber Resilience

CVE-2019-25305

HighPublic PoC

Published: 06 February 2026

Published
06 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0013 2.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25305 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Inforprograma (inferred from references). Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).

Deeper analysis

CVE-2019-25305 is an unquoted service path vulnerability affecting JumpStart version 0.6.0.0. The issue resides in the jswpbapi service, which runs with LocalSystem privileges. This misconfiguration allows the service path containing spaces to be exploited, enabling arbitrary code execution.

A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required. Successful exploitation grants the attacker elevated system permissions, resulting in high confidentiality, integrity, and availability impacts (CVSS 7.8). The attacker can inject and execute malicious code in the context of LocalSystem.

Advisories and related resources, including an exploit at https://www.exploit-db.com/exploits/47549, details at https://www.inforprograma.net/, and a vulnerability advisory at https://www.vulncheck.com/advisories/jumpstart-jswpbapi-unquoted-service-path, provide further technical information on the issue.

An exploit is publicly available, indicating potential for real-world abuse by local attackers on affected systems.

EU & UK References

Vulnerability details

JumpStart 0.6.0.0 contains an unquoted service path vulnerability in the jswpbapi service running with LocalSystem privileges. Attackers can exploit the unquoted path containing spaces to inject and execute malicious code with elevated system permissions.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1574.009 Path Interception by Unquoted Path Stealth
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Why these techniques?

Unquoted service path in LocalSystem service directly matches Path Interception by Unquoted Path (T1574.009), enabling local privilege escalation via malicious binary placement.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-36928Shared CWE-428
CVE-2023-54336Shared CWE-428
CVE-2020-37048Shared CWE-428
CVE-2019-25306Shared CWE-428
CVE-2020-36979Shared CWE-428
CVE-2020-36929Shared CWE-428
CVE-2020-37017Shared CWE-428
CVE-2021-47859Shared CWE-428
CVE-2019-25309Shared CWE-428
CVE-2021-47790Shared CWE-428

Affected Assets

Inforprograma
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Mandates secure configuration settings for services, including properly quoted executable paths with spaces, directly preventing exploitation of unquoted service path vulnerabilities.

prevent

Enforces least privilege for services, limiting the impact of code execution even if an unquoted service path is exploited by requiring non-LocalSystem accounts where possible.

detect

Requires vulnerability scanning that identifies unquoted service path misconfigurations like CVE-2019-25305 for timely remediation.

References