CVE-2025-41359

# PoC to check for Unquoted Service Path Vulnerability # This script checks if the service path is quoted and contains spaces. $serviceName = "SmallHTTPServer" # Adjust service name if necessary try { $service = Get-WmiObject -Class Win32_Service -Filter "Name='$serviceName'" -ErrorAction Stop $path = $service.PathName Write-Host "Service Path: $path" # Check if path is quoted if ($path -notmatch '^"') { Write-Host "[!] Vulnerable: The service path is not quoted." # Check if path contains spaces, which makes it exploitable if ($path -match ' ') { Write-Host "[+] Exploitable: Path contains spaces." Write-Host "[!] An attacker can place a malicious executable in:" Write-Host " C:\Program.exe" Write-Host " C:\Program Files.exe" } else { Write-Host "[-] Not exploitable via spaces (but still bad practice)." } } else { Write-Host "[+] Safe: The service path is properly quoted." } } catch { Write-Host "Error: Service '$serviceName' not found." }

{"cve": {"id": "CVE-2025-41359", "sourceIdentifier": "[email protected]", "published": "2026-03-26T13:16:25.277", "lastModified": "2026-03-26T21:04:16.050", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\\Program Files (x86)\\shttps_mg\\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access."}, {"lang": "es", "value": "Vulnerabilidad relacionada con una ruta de servicio sin comillas en Small HTTP Server 3.06.36, afectando específicamente al ejecutable ubicado en 'C:\\Program Files (x86)\\shttps_mg\\http.exe service'. Esta mala configuración permite a un atacante local colocar un ejecutable malicioso con el mismo nombre en un directorio de mayor prioridad, haciendo que el servicio ejecute el archivo malicioso en lugar del legítimo. Explotar esta falla podría permitir la ejecución de código arbitrario, acceso no autorizado al sistema o interrupción del servicio. Para mitigar el riesgo, la ruta del servicio debe estar correctamente entrecomillada, y los sistemas deben mantenerse actualizados con los parches de seguridad, mientras se restringe el acceso físico y de red."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.5, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-428"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:smallsrv:small_http_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.06.36", "versionEndExcluding": "3.06.38", "matchCriteriaId": "59C8C025-8748-4B3B-81C4-AD59BE3D4EA9"}]}]}], "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-small-http-server-smallsrv", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}