CVE-2019-25269

Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges by placing executable files in specific directory locations.

CVSS v4.0

8.5 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.33% chance of exploitation in the next 30 days, 25th percentile

Published

2026-02-04

Updated

2026-02-06

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/47747

References

• CVE Record
• NVD entry

Related

• CVE-2019-25268
• CVE-2019-25270
• CVE-2019-25267
• CVE-2019-25271
• CVE-2019-25266
• CVE-2019-25272