CVE-2022-50903

HighPublic PoC

Published: 13 January 2026

Published

13 January 2026

Modified

28 January 2026

KEV Added

—

Patch

—

CVSS Score 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 4.9th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-50903 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wondershare Mobiletrans. Its CVSS base score is 8.4 (High).

Operationally, ranked at the 4.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and CM-7 (Least Functionality).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the unquoted service path flaw in Wondershare MobileTrans ElevationService through timely patching or flaw correction.

CM-6 Configuration Settings good match

prevent

Establishes and maintains secure configuration settings for services, ensuring executable paths are properly quoted to block path hijacking exploits.

CM-7 Least Functionality good match

prevent

Restricts system to least functionality via application whitelisting, preventing execution of malicious binaries placed in locations exploitable by the unquoted service path.

NVD Description

Wondershare MobileTrans 3.5.9 contains an unquoted service path vulnerability in the ElevationService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path by placing malicious executables in specific filesystem locations that will…

be executed with LocalSystem permissions during service startup.

Deeper analysisAI

CVE-2022-50903 is an unquoted service path vulnerability in the ElevationService component of Wondershare MobileTrans version 3.5.9. This issue, classified under CWE-428, enables local users to potentially execute arbitrary code with elevated system privileges by exploiting the unquoted path during service startup.

The vulnerability has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity with low attack complexity and no privileges required. Local attackers can exploit it by placing malicious executables in specific filesystem locations, which are then executed with LocalSystem permissions when the service starts, allowing full control over the system including high impacts to confidentiality, integrity, and availability.

Advisories and related resources include a proof-of-concept exploit at https://www.exploit-db.com/exploits/50756, a VulnCheck advisory at https://www.vulncheck.com/advisories/wondershare-mobiletrans-elevationservice-unquoted-service-path, and the vendor site at https://www.wondershare.com/.