CVE-2022-50693: Splashtop Privilege Escalation Flaw

CVE-2022-50693 Overview

CVE-2022-50693 is an unquoted service path vulnerability affecting Splashtop version 8.71.12001.0. The vulnerability exists in the Splashtop Software Updater Service, where the service executable path is not properly quoted. This allows local attackers to potentially execute arbitrary code by placing malicious executables in strategic locations along the unquoted path, leading to privilege escalation on affected systems.

Critical Impact

Local attackers can exploit the unquoted service path to execute arbitrary code with elevated privileges, potentially gaining full control of the affected system.

Affected Products

• Splashtop 8.71.12001.0
• Splashtop Software Updater Service

Discovery Timeline

• 2026-01-13 - CVE-2022-50693 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2022-50693

Vulnerability Analysis

This vulnerability is classified as CWE-428 (Unquoted Search Path or Element). When Windows services are configured with executable paths that contain spaces and are not enclosed in quotation marks, the operating system interprets the path in an unintended manner. In this case, the Splashtop Software Updater Service path C:\Program Files (x86)\Splashtop\Splashtop Software Updater\ contains multiple spaces but lacks proper quoting.

When the service starts, Windows attempts to locate the executable by parsing the path at each space character. This creates opportunities for attackers to place malicious executables at intermediate path locations such as C:\Program.exe or C:\Program Files (x86)\Splashtop\Splashtop.exe. If a malicious file exists at one of these locations, it will be executed instead of the legitimate service binary, with the privileges of the service account.

Root Cause

The root cause of this vulnerability is improper configuration of the Windows service path during installation. The service path for the Splashtop Software Updater was stored in the Windows Registry without surrounding quotation marks, allowing Windows path parsing behavior to be exploited. Proper installation procedures should ensure all service paths containing spaces are enclosed in double quotes.

Attack Vector

The attack vector is local, requiring the attacker to have existing access to the system with sufficient permissions to write files to specific directories in the file path hierarchy. An attacker would place a malicious executable named Program.exe in the C:\ directory or Splashtop.exe in C:\Program Files (x86)\Splashtop\. When the vulnerable service restarts or the system reboots, Windows will execute the malicious binary instead of the legitimate Splashtop updater service, running with the service's elevated privileges.

The exploitation process involves:

1. Identifying the unquoted service path in the Windows Registry
2. Determining writable locations along the path hierarchy
3. Placing a malicious executable at a location that matches a partial path interpretation
4. Waiting for or triggering a service restart to execute the payload

Detection Methods for CVE-2022-50693

Indicators of Compromise

• Unexpected executables named Program.exe in the C:\ root directory
• Suspicious files named Splashtop.exe in C:\Program Files (x86)\Splashtop\
• Unusual service behavior or crashes of the Splashtop Software Updater Service
• Registry modifications to the Splashtop service ImagePath value

Detection Strategies

• Query Windows services for unquoted paths using PowerShell: Get-WmiObject win32_service | Where-Object {$_.PathName -notlike '"*"' -and $_.PathName -like '* *'}
• Monitor file creation events in C:\ and C:\Program Files (x86)\Splashtop\ directories
• Implement application whitelisting to prevent unauthorized executable execution
• Use endpoint detection tools to identify suspicious service configurations

Monitoring Recommendations

• Enable Windows Security Event logging for service starts (Event ID 7045) and process creation (Event ID 4688)
• Configure file integrity monitoring on directories in the affected path hierarchy
• Alert on new executable files created in C:\Program Files (x86)\ subdirectories
• Monitor for privilege escalation attempts from standard user accounts

How to Mitigate CVE-2022-50693

Immediate Actions Required

• Verify if Splashtop 8.71.12001.0 is installed on your systems
• Manually quote the service path in the Windows Registry to prevent exploitation
• Remove any suspicious executables from the C:\ root or intermediate path directories
• Monitor affected systems for signs of compromise until patching is complete

Patch Information

Organizations should check the Splashtop Official Site for updated versions that address this vulnerability. The VulnCheck Advisory for Splashtop provides additional technical details and remediation guidance. The Exploit-DB #51182 entry contains proof-of-concept information about this vulnerability.

Workarounds

• Manually fix the registry entry by adding quotation marks around the service path: Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SplashtopSoftwareUpdater and modify the ImagePath value to include quotes
• Restrict write permissions on the C:\ root directory and intermediate folders in the service path
• Implement application control policies to prevent execution of unauthorized binaries
• Consider disabling the Splashtop Software Updater Service until an official patch is available

# PowerShell command to fix unquoted service path
sc.exe config "Splashtop Software Updater" binPath= "\"C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe\""