CVE-2022-50928

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

BlueSoleilCS 5.4.277 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path in 'C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe' to inject malicious executables and escalate privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

Vendor	Product	Versions
IVT Corp	Bluetooth Application BlueSoleilCS	5.4.277

References

https://web.archive.org/web/20210624054150/http://ivtcorporation.com/Product
https://www.exploit-db.com/exploits/50761Exploit
https://www.vulncheck.com/advisories/bluetooth-application-bluesoleilcs-unquoted-service-pathThird Party Advisory
https://www.exploit-db.com/exploits/50761Exploit

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-509298.4Connectify Hotspot 2018 contains an unquoted service path vulnerability in its ConnectifyService executable that allows local attackers to p CVE-2022-509308.4Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to poten CVE-2022-509317.8TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious b CVE-2022-509327.5Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitiv CVE-2022-509337.8Cain & Abel 4.9.56 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with el CVE-2022-509359.8Flame II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unqu CVE-2022-509368.8WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets thro CVE-2022-509376.1Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links. Attacker CVE-2022-509388.4CONTPAQi AdminPAQ 14.0.0 contains an unquoted service path vulnerability in the AppKeyLicenseServer service running with LocalSystem privile CVE-2022-509397.2e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server f CVE-2022-509406.4Knap Advanced PHP Login 3.1.3 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scri CVE-2022-509416.4BootCommerce 3.2.1 contains persistent input validation vulnerabilities that allow remote attackers to inject malicious script code through