CVE-2022-50921
Published: 13 January 2026
Summary
CVE-2022-50921 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wow21 Wow21. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 8.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2022-50921 is an unquoted service path vulnerability (CWE-428) in WOW21 version 5.0.1.9. The issue affects the WoWService component, where the service binary path lacks proper quotation, enabling local attackers to potentially execute arbitrary code with elevated system privileges. Published on 2026-01-13 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it stems from an unquoted binary path that allows injection of malicious executables launched under LocalSystem permissions during service startup.
Local low-privileged attackers (PR:L) can exploit this with low attack complexity and no user interaction by placing a malicious executable in a directory parsed before the legitimate service binary during path resolution. Successful exploitation grants LocalSystem privileges, enabling full system compromise through arbitrary code execution with high impacts on confidentiality, integrity, and availability.
Advisories, including one from Vulncheck detailing the WoWSERVICE unquoted service path, and a proof-of-concept exploit on Exploit-DB (ID 50818), highlight the vulnerability but do not specify patches in the available references. An archived version of the vendor site (wow21.life) is also referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2605
Vulnerability details
WOW21 5.0.1.9 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with LocalSystem permissions during…
more
service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unquoted service path enables path interception for privilege escalation to LocalSystem via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
CM-6 enforces secure configuration settings for system components, directly preventing unquoted service paths like that in WOW21's WoWService by requiring properly quoted binary paths.
SI-2 requires identification, reporting, and remediation of system flaws such as the unquoted service path vulnerability in CVE-2022-50921, eliminating the privilege escalation risk.
RA-5 mandates vulnerability monitoring and scanning that specifically detects unquoted service path issues like CVE-2022-50921 for proactive remediation.