CVE-2022-50918
Unquoted Service Path in VIVE Runtime Allows Privilege Escalation
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| htc | vive_runtime_service | 1.0.0.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2022-50918 is an unquoted service path vulnerability in the VIVE Runtime Service version 1.0.0.4, specifically affecting the ViveAgentService. Because the service's binary path contains spaces but is not enclosed in quotes, a local attacker can place malicious executables in certain directories along the service path. When the service starts, it may execute these malicious files with elevated LocalSystem privileges, allowing the attacker to run arbitrary code with high system privileges. [1, 4]
How can this vulnerability impact me? :
This vulnerability allows a local attacker with low privileges to escalate their privileges to LocalSystem by placing a malicious executable in the service path. This can lead to arbitrary code execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected system. The attacker can gain full control over the system, potentially installing malware, stealing data, or disrupting system operations. [1, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking for unquoted service paths related to the VIVE Runtime Service, specifically the 'ViveAgentService'. On a Windows system, use the command: sc qc ViveAgentService to query the service configuration and inspect the binary path for missing quotes. Additionally, you can use PowerShell to list services with unquoted paths containing spaces, for example: Get-WmiObject win32_service | Where-Object { $_.PathName -match ' ' -and $_.PathName -notmatch '"' } | Select-Object Name, PathName. This helps identify if the ViveAgentService or other services have unquoted paths that could be exploited. [1, 4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include correcting the unquoted service path by enclosing the entire binary path in double quotes to prevent execution of malicious executables. For the ViveAgentService, update the service configuration to use a quoted path such as "C:\Program Files (x86)\VIVE\Updater\App\ViveRuntimeService\ViveAgentService.exe". Additionally, restrict write permissions on directories in the service path (e.g., "C:\Program Files (x86)\VIVE\") to prevent local attackers from placing malicious executables. Applying any available patches or updates from the vendor is also recommended. [1, 4]