CVE-2019-25310
Published: 11 February 2026
Summary
CVE-2019-25310 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Actfax (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2019-25310 is an unquoted service path vulnerability in ActiveFax Server 6.92 Build 0316, specifically affecting the ActiveFaxServiceNT service. This flaw enables local attackers to potentially execute arbitrary code by exploiting the unquoted binary path, allowing them to place malicious executables that will be launched with elevated administrative privileges. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H) and maps to CWE-428: Unquoted Search Path.
The attack requires local access with low privileges (PR:L) and has low complexity with no user interaction needed. An attacker can achieve privilege escalation by injecting a malicious executable into a writable directory parsed before the legitimate service path, resulting in high impacts to confidentiality, integrity, and availability as the payload executes under SYSTEM or administrative context.
References include the vendor site at https://www.actfax.com/, a proof-of-concept exploit at https://www.exploit-db.com/exploits/47503, and a Vulncheck advisory at https://www.vulncheck.com/advisories/activefax-server-build-activefaxservicent-unquoted-service-path, which provide further details on exploitation and potential mitigations such as service reconfiguration or patching if available from the vendor.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19455
Vulnerability details
ActiveFax Server 6.92 Build 0316 contains an unquoted service path vulnerability in the ActiveFaxServiceNT service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with…
more
elevated administrative privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly matches Path Interception by Unquoted Path (T1574.009), enabling local privilege escalation via malicious executable placement in the service binary path.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates secure configuration settings for system components, including properly quoting Windows service executable paths to directly prevent unquoted service path exploitation like CVE-2019-25310.
Requires timely identification, reporting, and correction of system flaws such as the unquoted service path in ActiveFaxServiceNT, through patching or reconfiguration.
Develops and maintains baseline configurations under change control that incorporate secure service path settings to mitigate unquoted path vulnerabilities.