CVE-2022-50902
Published: 13 January 2026
Summary
CVE-2022-50902 is a high-severity aka Blind XPath Injection (CWE-91) vulnerability in Wondershare FamiSafe (inferred from references). Its CVSS base score is 8.4 (High).
Operationally, ranked at the 9.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Establishes and enforces secure configuration settings for the FSService, including quoted executable paths and restrictive permissions on intermediate directories to directly prevent unquoted service path exploitation.
Identifies, reports, and corrects the specific unquoted service path flaw in Wondershare FamiSafe through timely patching or configuration remediation.
Enforces least privilege by configuring FSService to run under minimal necessary accounts instead of LocalSystem, limiting the privileges gained from exploiting the unquoted path.
NVD Description
Wondershare FamiSafe 1.0 contains an unquoted service path vulnerability in the FSService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Wondershare\FamiSafe\ to inject malicious code that would run…
more
with LocalSystem permissions during service startup.
Deeper analysisAI
Wondershare FamiSafe 1.0 contains an unquoted service path vulnerability in the FSService component, classified under CVE-2022-50902 and CWE-91. This flaw affects the service path configured as C:\Program Files (x86)\Wondershare\FamiSafe\, enabling local users to potentially execute arbitrary code with elevated privileges. The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to low complexity and no prerequisite privileges.
Local attackers with access to the system can exploit this vulnerability by placing a malicious executable in one of the directories parsed by the unquoted service path, such as before a space in the path. When the FSService starts, typically during system boot or manual initiation, it executes the injected code with LocalSystem permissions, granting full control over the system including high confidentiality, integrity, and availability impacts.
Advisories and resources detail the issue, including a proof-of-concept exploit published on Exploit-DB (https://www.exploit-db.com/exploits/50757) and a dedicated advisory from VulnCheck (https://www.vulncheck.com/advisories/wondershare-famisafe-fsservice-unquoted-service-path). The vendor's site (https://www.wondershare.com/) is referenced, though specific patch details are not outlined in available information. Security practitioners should verify service configurations and apply updates if available to mitigate risks.
Details
- CWE(s)