Cyber Resilience

CVE-2022-50914

HighPublic PoC

Published: 13 January 2026

Published
13 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0018 7.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2022-50914 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Easeus (inferred from references). Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 7.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2022-50914 is an unquoted service path vulnerability (CWE-428) in EaseUS Data Recovery version 15.1.0.0, specifically affecting the EaseUS UPDATE SERVICE executable. Published on 2026-01-13, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.

The vulnerability enables a local attacker requiring no privileges to exploit the unquoted path with low complexity and no user interaction. Attackers can inject and execute arbitrary malicious code elevated to LocalSystem privileges, allowing full control over the affected system.

Advisories from Vulncheck detail the unquoted service path issue in ensServer.exe, while a proof-of-concept exploit is publicly available on Exploit-DB (ID 50886). The vendor's site at https://www.easeus.com/ provides additional context, though no specific patch details are outlined in the referenced materials.

EU & UK References

Vulnerability details

EaseUS Data Recovery 15.1.0.0 contains an unquoted service path vulnerability in the EaseUS UPDATE SERVICE executable. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1574.009 Path Interception by Unquoted Path Stealth
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Unquoted service path (CWE-428) in Windows service directly matches path interception by unquoted path; enables local privilege escalation to SYSTEM via malicious binary placement.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-36982Shared CWE-428
CVE-2020-36987Shared CWE-428
CVE-2021-47825Shared CWE-428
CVE-2020-37059Shared CWE-428
CVE-2020-36953Shared CWE-428
CVE-2022-50935Shared CWE-428
CVE-2021-47864Shared CWE-428
CVE-2020-37060Shared CWE-428
CVE-2019-25308Shared CWE-428
CVE-2021-47845Shared CWE-428

Affected Assets

Easeus
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-2 mandates timely identification, reporting, and remediation of system flaws such as unquoted service paths, directly preventing exploitation of CVE-2022-50914.

prevent

CM-6 requires secure configuration settings for system components, including properly quoted paths for services like ensServer.exe to block malicious code injection.

prevent

AC-6 enforces least privilege for service processes, limiting the damage from LocalSystem privilege escalation via the unquoted service path vulnerability.

References