CVE-2025-5191 Overview
CVE-2025-5191 is an unquoted search path vulnerability [CWE-428] in the SerialInterfaceService.exe utility bundled with Moxa's industrial computers running Windows. A local attacker with limited privileges can place a malicious executable in a higher-priority directory within the service's search path. When the Serial Interface service starts, Windows executes the attacker-controlled binary with SYSTEM privileges. Successful exploitation results in privilege escalation and can enable persistence on the affected host. The vulnerability affects the local device only and does not propagate to downstream systems.
Critical Impact
A local low-privileged user can escalate to SYSTEM by dropping a malicious binary into an unquoted path segment consumed by the Moxa Serial Interface service.
Affected Products
- Moxa industrial computers running Windows with the affected utility installed
- SerialInterfaceService.exe (Serial Interface service)
- Refer to Moxa Security Advisory MPSA-256421 for the specific product and firmware list
Discovery Timeline
- 2025-08-25 - CVE-2025-5191 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5191
Vulnerability Analysis
The flaw resides in how the Serial Interface service is registered on Windows. When a Windows service ImagePath value contains spaces and is not wrapped in quotation marks, the Service Control Manager interprets each space as a potential path terminator. Windows then attempts to execute each candidate path in order until it finds a matching executable. An attacker who can write to any intermediate directory along that path can plant a binary that Windows loads before the legitimate service executable. Because Windows services typically run as LocalSystem, the planted binary inherits SYSTEM-level privileges at service start. Restarting the host or the service, both of which are common on industrial endpoints, triggers execution.
Root Cause
The root cause is an improperly quoted ImagePath registry value for the Serial Interface service. The installer registers SerialInterfaceService.exe under a directory containing spaces without surrounding the full path in quotes. This maps directly to CWE-428 (Unquoted Search Path or Element).
Attack Vector
Exploitation requires local access and low privileges on the Windows host. The attacker enumerates services with unquoted paths, identifies a writable directory along the search path, drops a malicious executable named to match the first tokenized path segment, and waits for the service to start. No user interaction is required beyond triggering a service restart or system reboot. The vulnerability does not expose adjacent systems.
No verified public exploit or proof-of-concept is currently available. Technical details are described in prose because no verified code samples are published.
Detection Methods for CVE-2025-5191
Indicators of Compromise
- Presence of unexpected executables in root-level or intermediate directories such as C:\Program.exe or C:\Program Files\Moxa.exe
- Windows Service Control Manager events (Event ID 7045, 7036) referencing the Serial Interface service starting an unexpected image
- New or modified files in writable path segments preceding the legitimate SerialInterfaceService.exe location
- Child processes spawned from services.exe running under SYSTEM that do not match the expected Moxa binary hash
Detection Strategies
- Enumerate all Windows services and flag any with unquoted ImagePath values containing spaces using wmic service get name,pathname,startmode or PowerShell Get-CimInstance Win32_Service
- Alert on file-write events targeting directories in the service search path when the writing process is not a trusted installer
- Correlate service-start events with process-creation telemetry to identify unexpected SYSTEM-level binaries
Monitoring Recommendations
- Baseline the expected hash and path of SerialInterfaceService.exe and alert on deviations
- Monitor writes to C:\, C:\Program Files\, and other directories that appear before the service binary in the unquoted path
- Track service configuration changes via Sysmon Event ID 13 (registry modification) on the ImagePath value under HKLM\SYSTEM\CurrentControlSet\Services
How to Mitigate CVE-2025-5191
Immediate Actions Required
- Apply the vendor-supplied update referenced in Moxa Security Advisory MPSA-256421
- Audit all services on affected hosts for unquoted paths and remediate any additional instances
- Restrict write access on directories that sit along the service search path to administrators only
- Restrict local logon on industrial computers to authorized operators
Patch Information
Moxa has published guidance for CVE-2025-5191 in advisory MPSA-256421. Administrators should install the fixed version of the industrial computer utility as directed by the advisory. The patch corrects the service registration so that the ImagePath value is properly quoted.
Workarounds
- Manually quote the ImagePath registry value for the Serial Interface service if a patch cannot be applied immediately
- Remove write permissions from non-administrative users on C:\ and any parent directory of the service binary
- Disable the Serial Interface service on hosts that do not require it
# Verify and correct the unquoted ImagePath on Windows (run elevated)
# 1. Inspect the current ImagePath
reg query "HKLM\SYSTEM\CurrentControlSet\Services\SerialInterfaceService" /v ImagePath
# 2. Set a properly quoted ImagePath (adjust the path to match your install)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SerialInterfaceService" ^
/v ImagePath /t REG_EXPAND_SZ ^
/d "\"C:\Program Files\Moxa\SerialInterface\SerialInterfaceService.exe\"" /f
# 3. Restart the service to apply
sc stop SerialInterfaceService
sc start SerialInterfaceService
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
