CVE-2022-50938
Published: 13 January 2026
Summary
CVE-2022-50938 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Contpaqi (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 6.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2022-50938 is an unquoted service path vulnerability in CONTPAQi AdminPAQ 14.0.0, affecting the AppKeyLicenseServer service that runs with LocalSystem privileges. The issue allows attackers to exploit the unquoted path in the service binary configuration, enabling injection of malicious code along the path traversed during service startup. This can result in arbitrary code execution with elevated system privileges. The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-428 (Unquoted Search Path).
Local attackers require only low-complexity access to the system with no privileges or user interaction needed. By placing a malicious executable in a directory that the unquoted service path resolves to before the legitimate binary—such as through spaces or subdirectories in the path—the service startup process executes the attacker's code with LocalSystem privileges, potentially achieving full system compromise including high impacts on confidentiality, integrity, and availability.
Advisories and resources include the Vulncheck advisory at https://www.vulncheck.com/advisories/contpaqi-adminpaq-unquoted-service-path detailing the vulnerability, a proof-of-concept exploit at https://www.exploit-db.com/exploits/50690, and potential patches or downloads from the vendor at https://www.contpaqi.com/descargas.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2602
Vulnerability details
CONTPAQi AdminPAQ 14.0.0 contains an unquoted service path vulnerability in the AppKeyLicenseServer service running with LocalSystem privileges. Attackers can exploit the unquoted path to inject malicious code in the service binary path, potentially executing arbitrary code with elevated system privileges…
more
during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path enabling path interception for privilege escalation via malicious executable placement before legitimate service binary.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
CM-6 requires establishment and implementation of secure configuration settings for services, including properly quoted binary paths to directly prevent exploitation of unquoted service path vulnerabilities like CVE-2022-50938.
SI-2 mandates identification, reporting, and correction of system flaws, such as applying vendor patches for CVE-2022-50938 to remediate the unquoted service path issue.
AC-6 enforces least privilege for processes like the AppKeyLicenseServer service, reducing the impact of arbitrary code execution with LocalSystem privileges via the unquoted path vulnerability.