CVE-2019-25271: NETGATE Data Backup Privilege Escalation

CVE-2019-25271 Overview

CVE-2019-25271 is an unquoted service path vulnerability in NETGATE Data Backup 3.0.620. The flaw resides in the NGDatBckpSrv Windows service configuration, which registers its executable path without surrounding quotation marks. Windows resolves unquoted paths containing spaces by attempting to execute each path segment sequentially. A local attacker with write access to an intermediate directory can place a malicious executable that Windows loads when the service starts. Successful exploitation grants code execution under the LocalSystem account, yielding full privilege escalation on the host. The vulnerability is tracked under CWE-428 (Unquoted Search Path or Element).

Critical Impact
Local attackers with limited privileges can escalate to LocalSystem by planting an executable in an unquoted service path location, gaining full control of the affected Windows host.

Affected Products

NETGATE Data Backup 3.0.620
NGDatBckpSrv Windows service component
Windows hosts running the affected backup service

Discovery Timeline

2026-02-05 - CVE-2019-25271 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2019-25271

Vulnerability Analysis

The vulnerability is a classic Windows unquoted service path weakness. During installation, NETGATE Data Backup registers the NGDatBckpSrv service with an ImagePath registry value that contains spaces but lacks enclosing quotes. When the Service Control Manager (SCM) starts the service, it parses the path token-by-token using whitespace as a delimiter. The SCM attempts to execute each candidate executable in sequence until one is found.

For example, a path such as C:\Program Files\Netgate\Data Backup\NGDatBckpSrv.exe causes the SCM to try C:\Program.exe, then C:\Program Files\Netgate\Data.exe, before reaching the intended binary. An attacker who can write to any intermediate directory can place a malicious binary that the service will execute on the next start.

Root Cause

The root cause is improper quoting of the service binary path in the installer or service registration logic. The application did not wrap the ImagePath value in quotation marks before passing it to the SCM, leaving path parsing ambiguous when directory names contain spaces.

Attack Vector

Exploitation requires local access and the ability to write to a directory that sits along the unquoted path. An attacker drops a payload named to match a path token, such as Program.exe or Data.exe, in the appropriate directory. The payload executes as LocalSystem when the service starts, typically at boot or through a service restart. Refer to the VulnCheck Security Advisory and Exploit-DB entry 47746 for additional technical detail.

Detection Methods for CVE-2019-25271

Indicators of Compromise

Unexpected executables such as Program.exe, Data.exe, or Netgate.exe located in C:\ or C:\Program Files\ root directories.
New or modified service binaries running under LocalSystem that lack a valid digital signature.
NGDatBckpSrv service failures or restarts followed by unusual process creation events.

Detection Strategies

Audit Windows service configurations and flag entries where ImagePath contains spaces and is not wrapped in quotation marks.
Monitor for file write events to root directories such as C:\ and C:\Program Files\ from non-administrative users.
Correlate service start events (Event ID 7036) with subsequent child process creation under services.exe for unexpected binary names.

Monitoring Recommendations

Enable Sysmon Event ID 1 (process creation) and Event ID 11 (file create) for early identification of planted binaries.
Track changes to registry key HKLM\SYSTEM\CurrentControlSet\Services\NGDatBckpSrv\ImagePath.
Alert on any newly created .exe file in directories preceding a legitimate service binary path.

How to Mitigate CVE-2019-25271

Immediate Actions Required

Inventory all systems running NETGATE Data Backup 3.0.620 and identify the NGDatBckpSrv service configuration.
Restrict write permissions on C:\ and any directory along the unquoted service path to administrators only.
Manually quote the ImagePath registry value for the affected service until a vendor fix is applied.

Patch Information

No vendor patch is referenced in the published advisory data. Consult the Netgate Official Website for vendor updates, and review the VulnCheck Security Advisory for the latest remediation guidance.

Workarounds

Modify the service ImagePath registry value to enclose the full executable path in double quotes, then restart the service.
Apply NTFS access control lists that prevent non-privileged users from writing executables to C:\ and C:\Program Files\ root locations.
Remove the affected backup software if it is not business-critical, eliminating the vulnerable service entirely.

bash

# Configuration example: query and correct the unquoted ImagePath using PowerShell
# View current service path
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NGDatBckpSrv" -Name ImagePath

# Set a properly quoted path (adjust to actual install location)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NGDatBckpSrv" `
    -Name ImagePath `
    -Value '"C:\Program Files\Netgate\Data Backup\NGDatBckpSrv.exe"'

# Restart the service to apply
Restart-Service -Name NGDatBckpSrv