CVE-2022-50902
Published: 13 January 2026
Summary
CVE-2022-50902 is a high-severity aka Blind XPath Injection (CWE-91) vulnerability in Wondershare FamiSafe (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
Wondershare FamiSafe 1.0 contains an unquoted service path vulnerability in the FSService component, classified under CVE-2022-50902 and CWE-91. This flaw affects the service path configured as C:\Program Files (x86)\Wondershare\FamiSafe\, enabling local users to potentially execute arbitrary code with elevated privileges. The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to low complexity and no prerequisite privileges.
Local attackers with access to the system can exploit this vulnerability by placing a malicious executable in one of the directories parsed by the unquoted service path, such as before a space in the path. When the FSService starts, typically during system boot or manual initiation, it executes the injected code with LocalSystem permissions, granting full control over the system including high confidentiality, integrity, and availability impacts.
Advisories and resources detail the issue, including a proof-of-concept exploit published on Exploit-DB (https://www.exploit-db.com/exploits/50757) and a dedicated advisory from VulnCheck (https://www.vulncheck.com/advisories/wondershare-famisafe-fsservice-unquoted-service-path). The vendor's site (https://www.wondershare.com/) is referenced, though specific patch details are not outlined in available information. Security practitioners should verify service configurations and apply updates if available to mitigate risks.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2631
Vulnerability details
Wondershare FamiSafe 1.0 contains an unquoted service path vulnerability in the FSService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Wondershare\FamiSafe\ to inject malicious code that would run…
more
with LocalSystem permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception by unquoted path (T1574.009) for arbitrary code execution as LocalSystem, facilitating local privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for the FSService, including quoted executable paths and restrictive permissions on intermediate directories to directly prevent unquoted service path exploitation.
Identifies, reports, and corrects the specific unquoted service path flaw in Wondershare FamiSafe through timely patching or configuration remediation.
Enforces least privilege by configuring FSService to run under minimal necessary accounts instead of LocalSystem, limiting the privileges gained from exploiting the unquoted path.