CVE-2022-50928
Published: 13 January 2026
Summary
CVE-2022-50928 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Ivtcorporation Bluesoleilcs. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 8.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SA-22 (Unsupported System Components).
Deeper analysis
CVE-2022-50928 is an unquoted service path vulnerability affecting BlueSoleilCS version 5.4.277, a Windows service from IVT Corporation's BlueSoleil Bluetooth application. The issue stems from the service configuration specifying an unquoted binary path at 'C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe', which violates CWE-428 (Unquoted Search Path or Element). This flaw has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts for local systems.
Local attackers with low-privilege access (PR:L) can exploit this vulnerability by placing a malicious executable in a directory that the Windows service resolver searches before the legitimate path, such as exploiting spaces in "Program Files" or "IVT Corporation". Successful exploitation allows arbitrary code execution with elevated privileges under the service's context, potentially leading to full system compromise.
Advisories and resources, including the Vulncheck advisory on the Bluetooth application BlueSoleilCS unquoted service path and Exploit-DB entries (e.g., exploits/50761), document the vulnerability and provide proof-of-concept exploits. No specific patches are referenced, but standard mitigations for unquoted service paths involve correcting the service binary path configuration or removing the vulnerable software. The IVT Corporation website is archived as of 2021, suggesting limited ongoing support.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2609
Vulnerability details
BlueSoleilCS 5.4.277 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path in 'C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe' to inject malicious executables and escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path enabling local path interception for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
CM-6 enforces and documents secure configuration settings for system components, including properly quoted binary paths in Windows service configurations to directly prevent unquoted service path exploitation like CVE-2022-50928.
SI-2 requires organizations to identify, report, and correct system flaws such as the unquoted service path in BlueSoleilCS, enabling timely remediation to block privilege escalation.
SA-22 prohibits the use of unsupported system components like the archived BlueSoleil 5.4.277 software, eliminating the vulnerable service and its unquoted path entirely.