CVE-2022-50935
Published: 13 January 2026
Summary
CVE-2022-50935 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2022-50935 is an unquoted service path vulnerability (CWE-428) in the Windows service configuration of the Flame II HSPA USB Modem, specifically affecting the path 'C:\Program Files (x86)\Internet Telcel\ApplicationController.exe'. This flaw allows the service binary path to be exploited due to improper quoting, enabling attackers to hijack the service execution. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impact on confidentiality, integrity, and availability.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. By placing a malicious executable in a location that the unquoted path traversal would resolve to before the legitimate binary, attackers can achieve arbitrary code execution with elevated SYSTEM privileges on the target Windows system hosting the modem driver or service.
Advisories and related resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/flame-ii-modem-usb-unquoted-service-path and an exploit proof-of-concept at https://www.exploit-db.com/exploits/50708, provide further technical details. The original product page is archived at https://web.archive.org/web/20160402093509/https://www.telcel.com/personas/equipos/modems-usb/alcatel/x602a. No specific patches are detailed in the provided information, but practitioners should isolate affected modems, reconfigure services with quoted paths, or remove the software where possible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2601
Vulnerability details
Flame II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\Internet Telcel\ApplicationController.exe' to execute arbitrary code with elevated system privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception for arbitrary code execution as SYSTEM (T1574.009); maps to privilege escalation via service hijack (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces and documents secure configuration settings for Windows services, including proper quoting of executable paths like 'C:\Program Files (x86)\Internet Telcel\ApplicationController.exe' to directly prevent unquoted path hijacking.
Implements application whitelisting with deny-by-default policy to block execution of unauthorized malicious executables placed to exploit the unquoted service path vulnerability.
Mandates timely identification, reporting, and remediation of flaws such as the unquoted service path in the Flame II HSPA USB Modem software to eliminate the vulnerability.