CVE-2019-25274: ProShow Producer Privilege Escalation Flaw

CVE-2019-25274 Overview

ProShow Producer 9.0.3797 contains an unquoted service path vulnerability in the ScsiAccess service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup.

Critical Impact

Local attackers with write permissions to the service path can achieve privilege escalation to LocalSystem by placing a malicious executable in the unquoted path, enabling complete system compromise.

Affected Products

• ProShow Producer version 9.0.3797
• ScsiAccess service component
• Windows systems running affected ProShow Producer installations

Discovery Timeline

• 2026-02-05 - CVE-2019-25274 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2019-25274

Vulnerability Analysis

This vulnerability falls under CWE-428 (Unquoted Search Path or Element), a class of flaws where the software constructs a service executable path without proper quotation marks. When Windows attempts to start a service with an unquoted path containing spaces, it parses the path in a predictable manner that can be exploited by attackers.

The ScsiAccess service in ProShow Producer 9.0.3797 registers its executable path without enclosing quotes. When the path contains directory names with spaces (common in Windows installations like C:\Program Files\), Windows interprets each space as a potential argument delimiter and attempts to execute files at each truncation point sequentially.

Root Cause

The root cause stems from improper service registration where the ImagePath registry value for the ScsiAccess service was set without surrounding quotation marks. When installing the service, the application failed to properly escape or quote the binary path, creating an exploitable condition. This is a common oversight during software development when using Windows service installation APIs or manual registry manipulation without proper path sanitization.

Attack Vector

This is a local attack vector requiring the attacker to have local access to the vulnerable system. The exploitation process involves:

1. Identifying the unquoted service path for ScsiAccess
2. Locating a writable directory within the path where a malicious executable can be placed
3. Dropping a payload named to match the expected truncation point (e.g., Program.exe in C:\)
4. Waiting for or triggering a service restart, which causes Windows to execute the malicious binary with LocalSystem privileges

The attacker needs write access to one of the intermediate directories in the service path. For example, if the service path is C:\Program Files\Photodex\ProShow Producer\ScsiAccess.exe, an attacker with write access to C:\ could place Program.exe there. When the service restarts, Windows first attempts to execute C:\Program.exe before finding the correct path.

For detailed technical information about this vulnerability, see the VulnCheck Advisory for ProShow and Exploit-DB #47705.

Detection Methods for CVE-2019-25274

Indicators of Compromise

• Unexpected executables named Program.exe, Photodex.exe, or similar in root directories or intermediate paths
• New executable files appearing in C:\ or C:\Program Files\ directories that don't belong to legitimate software
• Service execution logs showing unusual process spawning from the ScsiAccess service context
• Unauthorized processes running with LocalSystem privileges that correlate with service start times

Detection Strategies

• Query Windows services for unquoted paths using PowerShell: Get-WmiObject Win32_Service | Where-Object { $_.PathName -notmatch '^".*"$' -and $_.PathName -match ' ' }
• Monitor file system changes in root directories and common unquoted path locations for new executable files
• Implement application whitelisting to prevent execution of unauthorized binaries in sensitive paths
• Review Windows Event Logs (Event ID 7045) for service installation and changes to service configurations

Monitoring Recommendations

• Deploy endpoint detection rules to alert on executable file creation in C:\ and C:\Program Files\ directories
• Monitor the ScsiAccess service for unexpected child process execution
• Implement file integrity monitoring on directories commonly targeted by unquoted service path exploits
• Configure SIEM rules to correlate service startup events with unusual process behavior

How to Mitigate CVE-2019-25274

Immediate Actions Required

• Audit all installed services for unquoted paths and remediate by adding quotation marks to the ImagePath registry values
• Restrict write permissions on root directories and intermediate paths where malicious executables could be planted
• Consider uninstalling ProShow Producer if not actively required, as Photodex has discontinued the product
• Implement application control policies to prevent unauthorized executable files from running

Patch Information

ProShow Producer is a discontinued product from Photodex, and no official patch is available for this vulnerability. Organizations using this software should consider migrating to alternative solutions. For more information about the vendor, visit the Photodex Homepage.

Workarounds

• Manually fix the unquoted service path by modifying the registry ImagePath value to include quotation marks around the executable path
• Remove write permissions from intermediate directories in the service path for non-administrative users
• Disable or remove the ScsiAccess service if SCSI device access is not required for your workflows
• Deploy endpoint protection solutions like SentinelOne that can detect and block privilege escalation attempts via unquoted service paths

# Configuration example - Fix unquoted service path via registry
# Run as Administrator in PowerShell
$servicePath = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\ScsiAccess" -Name ImagePath).ImagePath
if ($servicePath -notmatch '^".*"$') {
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\ScsiAccess" -Name ImagePath -Value "`"$servicePath`""
    Write-Host "Service path has been quoted successfully"
}