CVE-2019-25272 in CyberPlanet
Summary
by MITRE • 02/05/2026
TexasSoft CyberPlanet 6.4.131 contains an unquoted service path vulnerability in the CCSrvProxy service that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\TenaxSoft\CyberPlanet\SrvProxy.exe' to inject malicious executables and gain elevated system privileges.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/08/2026
The vulnerability identified as CVE-2019-25272 represents a critical security flaw in TexasSoft CyberPlanet version 6.4.131 that stems from improper service path configuration. This issue specifically affects the CCSrvProxy service component which operates with elevated privileges and executes from a directory path that lacks proper quotation marks around the executable location. The absence of quotation marks in the service path creates a predictable attack vector that can be exploited by local adversaries to achieve privilege escalation. According to CWE-16, this vulnerability falls under the category of "Improper Handling of Environment Variables or Configuration Settings' where the service configuration fails to properly validate or sanitize the execution path. The service path C:\Program Files (x86)\TenaxSoft\CyberPlanet\SrvProxy.exe contains spaces in its directory structure, and without proper quotation marks in the service configuration, Windows will interpret this path as multiple separate components during execution.
The technical exploitation of this vulnerability occurs when an attacker places a malicious executable file in a directory that appears before the intended service path in the Windows search order. Since the service path is not quoted, Windows will first search for a program named "Program" in the root directory, then "Files" in the root, and so forth, ultimately executing the attacker's malicious binary instead of the legitimate service executable. This behavior aligns with the ATT&CK technique T1036.003 which describes masquerading through the use of unquoted service paths. The vulnerability allows attackers to gain elevated privileges because the CCSrvProxy service runs with system-level permissions, meaning any code executed through this vector will also run with the same elevated privileges. This creates a direct path to system compromise and privilege escalation.
The operational impact of CVE-2019-25272 extends beyond simple code execution as it provides attackers with a persistent foothold in the target system with full administrative capabilities. Local attackers who can write to directories in the service path can maintain access even after system reboots, as the malicious executable will continue to be executed whenever the service starts. The vulnerability affects systems running TexasSoft CyberPlanet 6.4.131 and potentially other versions that share the same unquoted service path configuration. This flaw is particularly dangerous in enterprise environments where multiple users may have local access to systems running this software, as it provides a low-effort path to system compromise. The vulnerability's exploitability is rated as high due to the minimal privileges required for exploitation and the elevated privileges gained through successful exploitation, making it a prime target for both insider threats and external attackers who have gained initial access to the system.
Mitigation strategies for this vulnerability involve multiple layers of defense that address both immediate remediation and long-term security hardening. The most direct and effective solution is to modify the service configuration to properly quote the service path, ensuring that Windows interprets the complete path as a single entity rather than multiple components. This can be accomplished through registry modification or using the sc command to update the service configuration. Organizations should also implement proper access controls to limit write permissions on directories in the service path, particularly those that precede the legitimate service executable. Additionally, regular security auditing should include verification of service path configurations to identify and remediate similar issues across the enterprise. System administrators should consider implementing application whitelisting policies that restrict execution of unauthorized binaries, and conduct regular vulnerability assessments to identify unquoted service paths in other software installations. The remediation process should also include monitoring for suspicious service execution patterns and ensuring that all systems running affected software are updated to versions that address this configuration flaw.