CVE-2022-50903
Unquoted Service Path in Wondershare MobileTrans ElevationService Allows Privilege Escalation
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wondershare | mobiletrans | 3.5.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unquoted service path issue in Wondershare MobileTrans version 3.5.9's ElevationService. Because the service path contains spaces but is not enclosed in quotes, a local attacker can place a malicious executable in certain filesystem locations along the service path. When the ElevationService starts, the system may execute the malicious executable instead of the legitimate one, running it with LocalSystem privileges. This allows the attacker to execute arbitrary code with elevated system privileges, effectively escalating their local privileges on the system. [1, 3]
How can this vulnerability impact me? :
This vulnerability can allow a local attacker to escalate their privileges to LocalSystem level by executing arbitrary code during the ElevationService startup. This means the attacker could gain full control over the affected system, compromising confidentiality, integrity, and availability of data and system resources. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for unquoted service paths in Windows services, specifically the ElevationService in Wondershare MobileTrans 3.5.9. You can use the Windows Management Instrumentation Command-line (WMIC) to query services and filter for unquoted paths excluding system directories. Additionally, the 'sc qc' command can be used to check the service configuration and confirm the executable path and privileges. For example, run 'wmic service get name,pathname | findstr /i "Wondershare"' to find the service path, and 'sc qc ElevationService' to view the service configuration and verify if the path is unquoted. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include correcting the unquoted service path by enclosing the entire executable path in quotes to prevent the system from misinterpreting the path and executing malicious executables. Alternatively, restrict local user permissions to prevent placing malicious executables in the vulnerable path locations. Ensuring that the service executable path is properly quoted and limiting local user write access to the service directories can help prevent exploitation. [1, 3]