CVE-2022-50903
Published: 13 January 2026
Summary
CVE-2022-50903 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wondershare Mobiletrans. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and CM-7 (Least Functionality).
Deeper analysis
CVE-2022-50903 is an unquoted service path vulnerability in the ElevationService component of Wondershare MobileTrans version 3.5.9. This issue, classified under CWE-428, enables local users to potentially execute arbitrary code with elevated system privileges by exploiting the unquoted path during service startup.
The vulnerability has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity with low attack complexity and no privileges required. Local attackers can exploit it by placing malicious executables in specific filesystem locations, which are then executed with LocalSystem permissions when the service starts, allowing full control over the system including high impacts to confidentiality, integrity, and availability.
Advisories and related resources include a proof-of-concept exploit at https://www.exploit-db.com/exploits/50756, a VulnCheck advisory at https://www.vulncheck.com/advisories/wondershare-mobiletrans-elevationservice-unquoted-service-path, and the vendor site at https://www.wondershare.com/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2635
Vulnerability details
Wondershare MobileTrans 3.5.9 contains an unquoted service path vulnerability in the ElevationService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path by placing malicious executables in specific filesystem locations that will…
more
be executed with LocalSystem permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in ElevationService directly enables path interception (T1574.009) by allowing malicious binaries in predictable locations to be executed with SYSTEM privileges on service start, resulting in local privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path flaw in Wondershare MobileTrans ElevationService through timely patching or flaw correction.
Establishes and maintains secure configuration settings for services, ensuring executable paths are properly quoted to block path hijacking exploits.
Restricts system to least functionality via application whitelisting, preventing execution of malicious binaries placed in locations exploitable by the unquoted service path.