CVE-2019-25310

HighPublic PoC

Published: 11 February 2026

Published

11 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 4.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25310 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Actfax (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

CM-6 Configuration Settings good match

prevent

Mandates secure configuration settings for system components, including properly quoting Windows service executable paths to directly prevent unquoted service path exploitation like CVE-2019-25310.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of system flaws such as the unquoted service path in ActiveFaxServiceNT, through patching or reconfiguration.

CM-2 Baseline Configuration good match

prevent

Develops and maintains baseline configurations under change control that incorporate secure service path settings to mitigate unquoted path vulnerabilities.

NVD Description

ActiveFax Server 6.92 Build 0316 contains an unquoted service path vulnerability in the ActiveFaxServiceNT service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with…

elevated administrative privileges.

Deeper analysisAI

CVE-2019-25310 is an unquoted service path vulnerability in ActiveFax Server 6.92 Build 0316, specifically affecting the ActiveFaxServiceNT service. This flaw enables local attackers to potentially execute arbitrary code by exploiting the unquoted binary path, allowing them to place malicious executables that will be launched with elevated administrative privileges. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H) and maps to CWE-428: Unquoted Search Path.

The attack requires local access with low privileges (PR:L) and has low complexity with no user interaction needed. An attacker can achieve privilege escalation by injecting a malicious executable into a writable directory parsed before the legitimate service path, resulting in high impacts to confidentiality, integrity, and availability as the payload executes under SYSTEM or administrative context.

References include the vendor site at https://www.actfax.com/, a proof-of-concept exploit at https://www.exploit-db.com/exploits/47503, and a Vulncheck advisory at https://www.vulncheck.com/advisories/activefax-server-build-activefaxservicent-unquoted-service-path, which provide further details on exploitation and potential mitigations such as service reconfiguration or patching if available from the vendor.