High severity · published Feb 4, 2026
CVE-2019-25281
NCP_Secure_Entry_Client 9.2 - Unquoted Service Paths
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
NCP Secure Entry Client 9.2 contains an unquoted service path vulnerability in multiple Windows services that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted paths in services like ncprwsnt, rwsrsu, ncpclcfg, and NcpSec to inject malicious code that would execute with LocalSystem privileges during service startup.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
NCP_Secure_Entry_Client · ncp-e
9.2x · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25281
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25281
software.ncp-e.com
http://software.ncp-e.com/
www.exploit-db.com
https://www.exploit-db.com/exploits/47668
www.vulncheck.com
https://www.vulncheck.com/advisories/ncpsecureentryclient-unquoted-service-paths
More from NCP_Secure_Entry_Client
9.8
CVE-2025-26155
NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability
8.1
CVE-2017-17023
The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com)