PT-2026-5814 · Lavasoft · Ad-Aware Web Companion

Published 2026-02-04 · Updated 2026-02-05 · CVE-2019-25287

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adaware Web Companion version 4.8.2078.3950

Description Adaware Web Companion version 4.8.2078.3950 contains an unquoted service path vulnerability in the WCAssistantService. This allows local users to potentially execute code with elevated privileges. An attacker can exploit the unquoted path located at C:Program Files (x86)LavasoftWeb CompanionApplication to inject malicious code. This injected code would execute with LocalSystem privileges during service startup.

Recommendations Update Adaware Web Companion to a version that addresses this issue. As a temporary workaround, restrict access to the vulnerable service WCAssistantService to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2019-25287

Affected Products

Ad-Aware Web Companion

References · 5

• 🔥 https://exploit-db.com/exploits/47597 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25287 · Security Note
• https://t.me/CVEtracker/43783 · Telegram Post
• https://webcompanion.com/en · Note
• https://vulncheck.com/advisories/adaware-web-companion-version-wcassistantservice-unquoted-service-path · Note