CVE-2022-50930
Published: 13 January 2026
Summary
CVE-2022-50930 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Emerson PAC Machine (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 3.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
Emerson PAC Machine Edition 9.80 is affected by CVE-2022-50930, an unquoted service path vulnerability in the TrapiServer service. This flaw, classified under CWE-428, arises from an improperly quoted executable path in the service configuration, enabling local users to potentially execute arbitrary code with elevated privileges. The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to the potential for complete system compromise.
A local attacker with access to the system can exploit this vulnerability by placing a malicious executable in a directory preceding the legitimate TrapiServer binary in the system's search path. When the service starts, typically running under LocalSystem privileges, it executes the attacker's code instead, granting full control over the system including high confidentiality, integrity, and availability impacts. No user interaction or privileges are required for exploitation, making it accessible to any local user.
Advisories and resources, including those from VulnCheck (https://www.vulncheck.com/advisories/emerson-pac-machine-edition-build-trapiserver-unquoted-service-path) and an exploit on Exploit-DB (https://www.exploit-db.com/exploits/50745), detail the issue and provide proof-of-concept exploitation. Vendor guidance from Emerson (https://www.emerson.com/en-us) and related sites like Opertek (https://www.opertek.com/descargar-software/?prc=_326) should be consulted for patching or configuration fixes to quote the service path properly.
A public exploit is available on Exploit-DB, indicating practical exploitability in lab environments, though no widespread real-world attacks have been reported in the provided data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2632
Vulnerability details
Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code…
more
that would execute with LocalSystem permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in TrapiServer directly enables path interception by placing a malicious binary earlier in the search path, executed with LocalSystem privileges on service start.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for services, including properly quoting executable paths to directly prevent unquoted service path hijacking in CVE-2022-50930.
Requires identification, reporting, and correction of flaws like the unquoted TrapiServer service path in CVE-2022-50930 through patching or configuration fixes.
Enforces least privilege for services like TrapiServer, limiting the privileges gained by attackers exploiting the unquoted path vulnerability in CVE-2022-50930.