CVE-2019-25231
devolo dLAN Cockpit 4.3.1 Unquoted Service Path Privilege Escalation
- State
- Published
- Severity
- 8.5 High
- Published
- Jan 7, 2026
- Updated
- Jan 8, 2026
- Reserved
- Dec 17, 2025
Description
devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the 'DevoloNetworkService' that allows local non-privileged users to potentially execute arbitrary code. Attackers can exploit the insecure service path configuration by inserting malicious code in the system root path to execute with elevated privileges during application startup or system reboot.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.4 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-428 Unquoted Search Path or Element
Affected Products
| Product | Versions |
|---|---|
devolo dLAN Cockpitdevolo AG |
|
References
- Zero Science Lab Vulnerability Advisorythird-party-advisory
- Packet Storm Security Exploit Entryexploit
- CXSecurity Vulnerability Listingthird-party-advisory
- IBM X-Force Vulnerability Exchangevdb-entry
- Devolo Vendor Homepageproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.