CVE-2019-25286
Unquoted Service Path in GCafé gbClientService Enables Privilege Escalation
Publication date: 2026-02-05
Last updated on: 2026-02-05
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gcafé | gcafé | to 3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2019-25286 is an unquoted service path vulnerability found in GCafé version 3.0, specifically in the 'gbClientService' Windows service configuration."}, {'type': 'paragraph', 'content': 'Because the service path is not enclosed in quotes, local attackers can place malicious executables in locations that the Windows service manager might incorrectly parse.'}, {'type': 'paragraph', 'content': 'When the service starts, these malicious executables can be executed with LocalSystem privileges, allowing attackers to run arbitrary code with elevated permissions.'}, {'type': 'paragraph', 'content': 'This vulnerability is categorized under CWE-428 (Unquoted Search Path or Element) and requires local access with low privileges but no user interaction.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to a full system compromise because attackers can execute arbitrary code with LocalSystem privileges.
- Attackers with local access can escalate their privileges from low-level user to system-level.
- Confidentiality, integrity, and availability of the affected system are all impacted at a high level.
- Malicious code execution can lead to unauthorized access, data theft, system manipulation, or denial of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by checking the service configuration for unquoted service paths, specifically for the 'gbClientService'."}, {'type': 'paragraph', 'content': 'Commands such as Windows Management Instrumentation Command-line (WMIC) and Service Control (sc) can be used to identify and confirm unquoted service paths.'}, {'type': 'list_item', 'content': 'Use WMIC to query the service path: wmic service where "name=\'gbClientService\'" get PathName'}, {'type': 'list_item', 'content': 'Use sc qc to query the service configuration: sc qc gbClientService'}, {'type': 'paragraph', 'content': 'If the service path returned by these commands is not enclosed in quotes and contains spaces, it indicates the presence of the unquoted service path vulnerability.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the service configuration to enclose the service path in double quotes.
This prevents Windows from misinterpreting the path and executing malicious executables placed in the path.
Additionally, restrict local user permissions to prevent unauthorized users from placing executables in directories referenced by the service path.
If possible, update GCafé to a version that addresses this vulnerability or apply any vendor-provided patches.