CVE-2019-25747: Network Inventory Advisor Privilege Escalation

CVE-2019-25747 Overview

CVE-2019-25747 is a local privilege escalation vulnerability in Network Inventory Advisor 5.0.26.0. The installer registers the niaservice Windows service with an unquoted binary path. A local attacker with write access to an intermediate directory in that path can place a malicious executable that Windows will launch with LocalSystem privileges when the service starts. The flaw is tracked under CWE-428: Unquoted Search Path or Element.

Critical Impact
A low-privileged local user can gain SYSTEM-level code execution on hosts running Network Inventory Advisor 5.0.26.0 by abusing the unquoted niaservice path.

Affected Products

Network Inventory Advisor 5.0.26.0
Installations registering the niaservice Windows service
Windows hosts where the service binary is installed under a path containing spaces

Discovery Timeline

2026-06-19 - CVE-2019-25747 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2019-25747

Vulnerability Analysis

Network Inventory Advisor 5.0.26.0 installs a Windows service named niaservice with an unquoted ImagePath registry value. When Windows starts a service whose path is unquoted and contains spaces, the Service Control Manager (SCM) attempts to execute each space-delimited token as an executable, appending .exe and treating later tokens as command-line arguments. This behavior creates predictable file-system locations where an attacker can stage a payload that Windows will execute under the service account.

The service runs as LocalSystem, so any binary launched through this path inherits full system privileges. Exploitation requires only local access and write permission to one of the intermediate directories in the unquoted path. Public exploitation details are documented in Exploit-DB #47584 and the VulnCheck advisory.

Root Cause

The root cause is a service installation routine that writes the binary path to the registry without surrounding quotation marks. Microsoft documentation requires service paths containing spaces to be quoted to prevent SCM from misinterpreting the path. The installer for Network Inventory Advisor 5.0.26.0 omits the quotes, leaving the resolution order exploitable.

Attack Vector

An attacker first enumerates services on the host using wmic service get name,pathname,startmode and identifies the unquoted niaservice entry. The attacker then writes a malicious executable named after the first unquoted token (for example, Program.exe placed in C:\) and waits for the service to restart, reboot the host, or trigger a restart through a legitimate mechanism. When SCM launches the service, it executes the planted binary as LocalSystem, granting the attacker full control of the system. No network access, user interaction, or memory corruption primitive is required.

Detection Methods for CVE-2019-25747

Indicators of Compromise

Unexpected executables in root drive paths such as C:\Program.exe or in subdirectories that align with intermediate tokens of the niaserviceImagePath
New or modified files in directories preceding the actual niaservice binary location, created by non-administrative users
Service start events (Event ID 7036) for niaservice correlated with new processes spawned from non-standard paths
Child processes of services.exe running from unexpected directories with LocalSystem token

Detection Strategies

Audit the registry value HKLM\SYSTEM\CurrentControlSet\Services\niaservice\ImagePath for missing quotation marks around paths containing spaces
Hunt for process creation events where the parent is services.exe and the image path does not match the expected Network Inventory Advisor install directory
Use wmic service get name,pathname,startmode or PowerShell Get-WmiObject Win32_Service to enumerate unquoted service paths across the fleet

Monitoring Recommendations

Monitor file-write events in root volume directories (C:\, C:\Program Files\) by non-administrative principals
Alert on creation of executables whose names match the first token of any unquoted service path
Track service configuration changes and service binary modifications through Windows Security event logs

How to Mitigate CVE-2019-25747

Immediate Actions Required

Inventory all hosts running Network Inventory Advisor 5.0.26.0 and identify the niaservice configuration
Manually quote the ImagePath registry value for niaservice to prevent SCM path resolution abuse
Restrict write permissions on root and intermediate directories along the service path to administrators only
Remove the software from hosts where it is not required for inventory operations

Patch Information

No vendor-issued patch is referenced in the available advisories. Refer to the vendor download page for the latest available release, and review the VulnCheck advisory for current remediation guidance.

Workarounds

Edit the niaserviceImagePath registry value to wrap the full executable path in double quotes
Apply NTFS ACLs that deny write and modify permissions on C:\ and any other directory preceding the service binary for non-administrative users
Disable the niaservice service if Network Inventory Advisor is not actively in use

bash

# Configuration example: quote the niaservice ImagePath to remediate the unquoted path
sc.exe config niaservice binPath= "\"C:\Program Files\Network Inventory Advisor\niaservice.exe\""
sc.exe qc niaservice