CVE-2019-7590
exacqVision Server Unquoted Service Path
- Published
- Updated
- Reserved
- Assigned by
- jci
Description
ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| jciCNA (assigner) | 3.0 | Medium6.7 | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.0 | High7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.83% · top 42% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.7.
Weakness
- CWE-428 Unquoted Search Path or Element (opens in a new tab)All about CWE-428 and its CVEs
- The exacqVision Server unquoted service path privilege escalation vulnerability is possible in the Windows operating system.
Affected products
Exacq Technologies, Inc. · exacqVision Server
- unknown unspecified – < 8.4
- unaffected unspecified – ≤ 9.4
- affected 9.6
- affected 9.8
- unaffected next of 19.03 – < unspecified
What to do
Solution: Upgrade to exacqVision Server 19.03
Workaround: Run Registry Editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\exacqVisionServer. Modify the ImagePath for to include quotations around the entire file path. Repeat this process for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dvrdhcpserver and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mdnsresponder
Exploitation: N/A
References (6)
- https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-Path-Privilege-Escalation.html (opens in a new tab)x_refsource_MISCx_transferred
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.php (opens in a new tab)x_refsource_MISCx_transferred
- https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341 (opens in a new tab)x_refsource_MISCx_transferred
- https://www.us-cert.gov/ics/advisories/icsa-19-199-01 (opens in a new tab)x_refsource_MISCx_transferred
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories (opens in a new tab)x_refsource_CONFIRMx_transferred
- 109307 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-7590)Record last updated .