- 6.7MediumCVSS base score
- 0.83%Exploitation in 30 daysEPSS · top 42% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.
Timeline
ID reserved
By jci
- 5 months later
· 5 months later
Published
- 5 years later
· 5 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| jciCNA (assigner) | 3.0 | Medium6.7 | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.0 | High7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.83% · top 42% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.7.
Affected products
Exacq Technologies, Inc. · exacqVision Server
- unknown unspecified – < 8.4
- unaffected unspecified – ≤ 9.4
- affected 9.6
- affected 9.8
- unaffected next of 19.03 – < unspecified
What to do
Solution: Upgrade to exacqVision Server 19.03
Workaround: Run Registry Editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\exacqVisionServer. Modify the ImagePath for to include quotations around the entire file path. Repeat this process for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dvrdhcpserver and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mdnsresponder
Exploitation: N/A
References
6
- https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-Path-Privilege-Escalation.html (opens in a new tab)x_refsource_MISCx_transferred
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.php (opens in a new tab)x_refsource_MISCx_transferred
- https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341 (opens in a new tab)x_refsource_MISCx_transferred
- https://www.us-cert.gov/ics/advisories/icsa-19-199-01 (opens in a new tab)x_refsource_MISCx_transferred
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories (opens in a new tab)x_refsource_CONFIRMx_transferred
- 109307 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2019-17128 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2019-7590)Record last updated .