PT-2026-5810 · Ncp · Rwsrsu+4

Published 2026-02-04 · Updated 2026-02-05 · CVE-2019-25281

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NCP Secure Entry Client version 9.2

Description NCP Secure Entry Client 9.2 contains a flaw due to unquoted service paths in multiple Windows services. This allows local users to potentially execute arbitrary code. Specifically, attackers can exploit unquoted paths in services such as ncprwsnt, rwsrsu, ncpclcfg, and NcpSec to inject malicious code. This code would then execute with LocalSystem privileges during service startup.

Recommendations Versions prior to 9.2 should be used. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2019-25281

Affected Products

Ncp Secure Entry Client

Ncpsec

Ncpclcfg

Ncprwsnt

Rwsrsu

References · 5

• 🔥 https://exploit-db.com/exploits/47668 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25281 · Security Note
• https://vulncheck.com/advisories/ncpsecureentryclient-unquoted-service-paths · Note
• http://software.ncp-e.com · Note
• https://t.me/CVEtracker/43780 · Telegram Post