Unquoted Search Path Vulnerability in Moxa Industrial Computers

CVE-2025-5191

What is CVE-2025-5191?

A vulnerability has been discovered in the SerialInterfaceService.exe utility for Moxa's industrial computers running Windows. The unquoted path configuration allows a local attacker, with limited privileges, to exploit the system by placing a malicious executable in a higher-priority directory within the search path. When the Serial Interface service is initiated, the malicious executable may execute with SYSTEM privileges, facilitating privilege escalation and potentially allowing the attacker to maintain persistent access to the affected system. This vulnerability poses significant risks to the device's operational integrity, although it does not directly compromise other systems.

References