CVE-2019-25358
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2019-25358 is a high-severity Assumed-Immutable Data is Stored in Writable Memory (CWE-1282) vulnerability in Sourceforge (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Modify System Image (T1601); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-34 (Non-modifiable Executable Programs) and SC-51 (Hardware-based Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25358 is a denial of service vulnerability affecting FileOptimizer version 14.00.2524. The issue arises from improper handling of the TempDirectory parameter in the FileOptimizer32.ini configuration file, where attackers can overwrite it with a 5000-character buffer. This manipulation causes the application to crash when the options dialog is opened. The vulnerability is associated with CWE-1282 and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Any unauthenticated attacker can exploit this vulnerability remotely with low complexity and no user interaction required. By crafting a malicious FileOptimizer32.ini file with an oversized TempDirectory value, the attacker triggers a crash upon the victim opening the options in the affected application, resulting in denial of service.
References include the SourceForge project pages for FileOptimizer, an Exploit-DB proof-of-concept (exploit 47586), and a Vulncheck advisory detailing the denial of service issue. These resources provide additional technical details, but no specific patch or mitigation steps are outlined in the available information. Security practitioners should review the advisories and avoid using the vulnerable version 14.00.2524.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19707
Vulnerability Data
FileOptimizer 14.00.2524 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the FileOptimizer32.ini configuration file. Attackers can overwrite the TempDirectory parameter with a 5000-character buffer to cause the application to crash when opening options.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Hardware-enforced read-only loading directly stops assumed-immutable data from residing in writable memory.
Hardware write-protect mechanisms structurally eliminate the ability to reprogram data that must remain immutable.
Integrity verification tools discover unauthorized modifications to firmware or configuration that should have stayed immutable.
Access restrictions on changes reduce the chance that immutable data can be modified after deployment.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting integrity of data-at-rest directly addresses tampering with assumed-immutable values stored in writable memory.
Secure SDLC activities should identify and eliminate storage of immutable data in field-writable memory.
Pre-acquisition integrity checks can catch devices or firmware that place immutable data in writable memory.
Configuration-management practices can enforce use of read-only or write-once storage for immutable data.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle mandates hardware-enforced immutability or protected storage for bootloaders and device identifiers.
Secure system architecture principles require hardware write-protection or one-time-programmable memory for immutable data.
Secure coding practices can avoid storing immutable data in writable memory but do not address hardware-level protection.
Change management can restrict field updates to immutable data but does not enforce the underlying storage design.
Configuration management enforces immutable firmware and write-once settings, directly preventing unauthorized reprogramming of assumed-immutable data.