CVE-2019-25310: ActiveFax Server Privilege Escalation Flaw

CVE-2019-25310 Overview

CVE-2019-25310 is an unquoted service path vulnerability affecting ActiveFax Server 6.92 Build 0316. The vulnerability exists in the ActiveFaxServiceNT service, where the binary path is not properly enclosed in quotation marks. This weakness allows local attackers to potentially execute arbitrary code by placing malicious executables in strategic locations along the unquoted path, which will then be launched with elevated administrative privileges when the service starts.

Critical Impact

Local attackers can achieve privilege escalation and arbitrary code execution by exploiting the unquoted service path to inject malicious executables that run with SYSTEM-level privileges.

Affected Products

• ActiveFax Server 6.92 Build 0316
• ActiveFaxServiceNT Windows Service

Discovery Timeline

• 2026-02-11 - CVE-2019-25310 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2019-25310

Vulnerability Analysis

This vulnerability falls under CWE-428 (Unquoted Search Path or Element), a configuration weakness that occurs when a Windows service path containing spaces is not enclosed in quotation marks. When Windows attempts to start a service with an unquoted path like C:\Program Files\ActiveFax\Server\ActFax.exe, it sequentially attempts to execute binaries at each space-delimited segment of the path before finding the intended executable.

The ActiveFaxServiceNT service runs with elevated privileges, typically as SYSTEM. An attacker with local access can place a malicious executable at one of the intermediate path locations (e.g., C:\Program.exe or C:\Program Files\ActiveFax\Server.exe). When the service restarts or the system reboots, Windows will execute the attacker's binary instead of the legitimate ActiveFax executable, granting the attacker SYSTEM-level privileges.

Root Cause

The root cause of this vulnerability is improper service configuration during the ActiveFax Server installation process. The installer fails to enclose the service binary path in quotation marks when registering the ActiveFaxServiceNT service with the Windows Service Control Manager. This oversight creates an exploitable condition in environments where directory paths contain spaces, which is common in Windows installations using the default C:\Program Files\ directory structure.

Attack Vector

The attack requires local access to the affected system. An attacker must have write permissions to at least one of the directories in the unquoted service path hierarchy. The exploitation process involves:

1. Identifying the unquoted service path using tools like wmic service get name,displayname,pathname,startmode or PowerShell queries
2. Creating a malicious executable designed to establish persistence or provide elevated access
3. Placing the malicious binary at a strategic location such as C:\Program.exe or within an intermediate directory path
4. Waiting for the service to restart (either through system reboot or manual service restart)

The vulnerability is exploitable when an attacker can write to directories earlier in the path resolution order. For additional technical details, see the Exploit-DB entry #47503 and the VulnCheck Advisory on ActiveFax.

Detection Methods for CVE-2019-25310

Indicators of Compromise

• Unexpected executable files in root directories (e.g., C:\Program.exe)
• New or modified files in C:\Program Files\ directory root matching service path segments
• Unusual process execution chains originating from the ActiveFaxServiceNT service
• Service startup failures or unexpected system behavior after service restarts

Detection Strategies

• Query Windows services for unquoted paths using wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """ to identify vulnerable services
• Monitor file creation events in directories along the service path using Windows Security Event Logs or endpoint detection tools
• Implement SentinelOne behavioral AI to detect anomalous process execution from service contexts
• Use file integrity monitoring to detect unauthorized additions to sensitive directory paths

Monitoring Recommendations

• Enable Windows Security Event logging for file creation events (Event ID 4663) in system directories
• Configure alerts for new executable file creation in C:\ and C:\Program Files\ root directories
• Monitor service-related events (Event IDs 7000, 7009, 7034, 7045) for ActiveFaxServiceNT anomalies
• Deploy SentinelOne Singularity Platform for real-time detection of privilege escalation attempts

How to Mitigate CVE-2019-25310

Immediate Actions Required

• Audit all Windows services on systems running ActiveFax Server to identify the unquoted path vulnerability
• Manually correct the service path by adding quotation marks around the binary path in the Windows Registry
• Restrict write permissions on directories along the service path to administrative accounts only
• Consider temporarily disabling the ActiveFaxServiceNT service until remediation is complete in non-critical environments

Patch Information

Contact ActiveFax (ActFax) for the latest version that addresses this configuration issue. Visit the ActFax Official Website for product updates and support information. Upgrade to the latest available build that properly quotes service paths during installation.

Workarounds

• Manually fix the registry entry by adding quotation marks: Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ActiveFaxServiceNT and modify the ImagePath value to enclose the path in quotes
• Use the sc config command to update the service path: sc config ActiveFaxServiceNT binPath= "\"C:\Program Files\ActiveFax\Server\ActFax.exe\""
• Implement application whitelisting to prevent execution of unauthorized binaries in system directories
• Apply the principle of least privilege by restricting local user write access to program directories

# Configuration example - Fix unquoted service path via registry
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ActiveFaxServiceNT" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\ActiveFax\Server\ActFax.exe\"" /f