CVE-2022-50923

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Cobian Backup 0.9 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the CobianReflectorService to inject malicious code that will execute with LocalSystem permissions during service startup.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

Vendor	Product	Versions
Cobiansoft	Cobian Backup	0.9.93

References

https://www.cobiansoft.com//Product
https://www.cobiansoft.com/download.php/Product
https://www.exploit-db.com/exploits/50810Exploit, VDB Entry
https://www.vulncheck.com/advisories/cobian-backup-unquoted-service-pathThird Party Advisory

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-509248.4Private Internet Access 3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code wi CVE-2022-509259.8Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an e CVE-2022-509269.8WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cook CVE-2022-509276.2Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the ad CVE-2022-509287.8BlueSoleilCS 5.4.277 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to pot CVE-2022-509298.4Connectify Hotspot 2018 contains an unquoted service path vulnerability in its ConnectifyService executable that allows local attackers to p CVE-2022-509308.4Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to poten CVE-2022-509317.8TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious b CVE-2022-509327.5Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitiv CVE-2022-509337.8Cain & Abel 4.9.56 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with el CVE-2022-509359.8Flame II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unqu CVE-2022-509368.8WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets thro