CVE-2022-50900
Published: 13 January 2026
Summary
CVE-2022-50900 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wondershare Dr.Fone. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 10.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2022-50900 is an unquoted service path vulnerability in Wondershare Dr.Fone version 12.0.18. The issue stems from a misconfigured service path, classified under CWE-428, which enables local users to execute arbitrary code with elevated system privileges. Specifically, attackers can insert malicious code that runs with LocalSystem permissions upon service startup.
The vulnerability has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating low attack complexity for local attackers requiring no privileges or user interaction. An attacker with local access can exploit the unquoted path by placing a malicious executable in a directory that the service searches before locating the legitimate binary, achieving full system compromise through privilege escalation.
Advisories and references include a proof-of-concept exploit on Exploit-DB (ID 50813) targeting the Wondershare InstallAssist service, a detailed VulnCheck advisory on the unquoted service path issue, and the vendor's site at wondershare.com. No specific patch or mitigation details are provided in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2643
Vulnerability details
Wondershare Dr.Fone 12.0.18 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploit the misconfigured service path to insert malicious code that will be executed with LocalSystem permissions during…
more
service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path (T1574.009) for local privilege escalation (T1068) via malicious executable placement before legitimate binary.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for system services, directly preventing unquoted service path vulnerabilities that enable privilege escalation.
Requires timely identification, reporting, and correction of flaws like unquoted service paths, mitigating the vulnerability before exploitation.
Vulnerability scanning detects misconfigurations such as unquoted service paths in installed software like Wondershare Dr.Fone.