CVE-2022-50933
Published: 13 January 2026
Summary
CVE-2022-50933 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Malavida Cain \& Abel. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 6.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and CM-7 (Least Functionality).
Deeper analysis
CVE-2022-50933 is an unquoted service path vulnerability affecting Cain & Abel version 4.9.56. This issue arises from an improperly quoted binary path in the service configuration, enabling local attackers to potentially execute arbitrary code with elevated privileges. By exploiting the unquoted path, attackers can inject malicious executables that the service launches under LocalSystem permissions. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-428 (Unquoted Search Path or Element).
Local low-privileged attackers can exploit this vulnerability with low attack complexity and no user interaction required. The scenario involves placing a malicious executable in a directory that the Windows service path resolution prioritizes over the legitimate binary. Upon service startup or restart, the injected executable runs with LocalSystem privileges, allowing full system compromise, including unauthorized access to sensitive data, modification of system files, and disruption of services.
Advisories, including those from VulnCheck and Exploit-DB, document the unquoted service path flaw and provide details on exploitation. A proof-of-concept exploit is available at https://www.exploit-db.com/exploits/50728. No patches or vendor-specific mitigations are referenced for this version of Cain & Abel.
A publicly available exploit on Exploit-DB indicates proof-of-concept exploitation is feasible, though no widespread real-world abuse is noted in the provided details. Cain & Abel, a legacy password recovery tool, appears unmaintained based on available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2624
Vulnerability details
Cain & Abel 4.9.56 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception by unquoted path (T1574.009) for local privilege escalation to LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates secure configuration settings for services, including properly quoting executable paths to directly prevent unquoted service path exploitation like CVE-2022-50933.
Prohibits use of unsupported and unmaintained system components such as Cain & Abel 4.9.56, eliminating the vulnerable service and its unquoted path flaw entirely.
Restricts systems to least functionality by prohibiting unnecessary high-privilege services like Cain & Abel, avoiding deployment of exploitable unquoted service paths.