CVE-2019-25307
Unquoted Service Path in WorkgroupMail 7.5.1 Enables Privilege Escalation
Publication date: 2026-02-11
Last updated on: 2026-02-11
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| workgroupmail | workgroupmail | 7.5.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2019-25307 is an unquoted service path vulnerability found in WorkgroupMail version 7.5.1 on Windows. The service executable path contains spaces but is not enclosed in quotes, which allows local attackers to place malicious executables in certain locations. When the service starts, Windows may execute the malicious executable instead of the legitimate one, leading to arbitrary code execution with LocalSystem privileges.
How can this vulnerability impact me? :
This vulnerability can lead to local privilege escalation, allowing an attacker with local access to execute arbitrary code with SYSTEM-level privileges. This means the attacker can gain full control over the affected system, potentially installing malware, stealing data, or disrupting system operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the Windows service configuration for unquoted service paths that contain spaces. Specifically, you should inspect the service path of the WorkgroupMail service to see if it is unquoted.
A common method to detect unquoted service paths is to use the Windows command line to query the service configuration.
- Run the command: sc qc WorkgroupMail
- Examine the BINARY_PATH_NAME output for spaces without surrounding quotes.
If the path is unquoted and contains spaces (e.g., C:\Program Files (x86)\WorkgroupMail\wmsvc.exe -s), the service is vulnerable to this issue.
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate this vulnerability, you should correct the unquoted service path by enclosing the entire executable path in double quotes.'}, {'type': 'paragraph', 'content': 'This prevents Windows from misinterpreting the path and executing malicious executables placed in intermediate directories.'}, {'type': 'list_item', 'content': 'Use the command: sc config WorkgroupMail binPath= ""C:\\Program Files (x86)\\WorkgroupMail\\wmsvc.exe" -s"'}, {'type': 'paragraph', 'content': 'Alternatively, ensure that no untrusted users have write permissions to any directories in the service path to prevent placing malicious executables.'}, {'type': 'paragraph', 'content': 'As a general security practice, restrict local access and monitor for suspicious files in the service path directories.'}] [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know