CVE-2022-50921 Overview
CVE-2022-50921 is an unquoted service path vulnerability affecting WOW21 version 5.0.1.9 on Windows systems. The flaw allows local attackers with limited privileges to place a malicious executable along the service's binary path. Windows Service Control Manager interprets the unquoted path ambiguously and launches the attacker-controlled binary with LocalSystem rights at service startup. This vulnerability is categorized under [CWE-428] Unquoted Search Path or Element.
Critical Impact
Local users can escalate privileges to LocalSystem by planting an executable in a writable directory along the unquoted service path, gaining full control over the affected host.
Affected Products
- WOW21 5.0.1.9 (Windows installer)
- Vendor: wow21
- Component: wow21:wow21
Discovery Timeline
- 2026-01-13 - CVE-2022-50921 published to NVD
- 2026-02-02 - Last updated in NVD database
Technical Details for CVE-2022-50921
Vulnerability Analysis
The vulnerability stems from how the WOW21 installer registers its Windows service. The service's ImagePath registry value contains a file system path with spaces but is not enclosed in quotation marks. When Windows Service Control Manager (SCM) parses the path during service startup, it tokenizes the string at each space character and attempts to execute each candidate sequentially until a valid executable is found.
An attacker with write access to any intermediate directory along the path can plant a malicious executable named to match an early candidate token. The SCM then executes the planted binary in place of the legitimate service binary. Because Windows services typically run under the LocalSystem account, the attacker's code inherits SYSTEM-level privileges.
This class of weakness has been a recurring local privilege escalation primitive in third-party Windows software for over a decade. See the VulnCheck Advisory and Exploit-DB #50818 for the original technical writeup.
Root Cause
The root cause is improper quoting of the service binary path in the Windows service definition installed by WOW21 5.0.1.9. The installer fails to wrap the ImagePath value in double quotes, leaving the path susceptible to SCM tokenization.
Attack Vector
Exploitation requires local access and write permissions to a directory that appears earlier in the unquoted path than the legitimate binary. The attacker places a crafted executable, then triggers service restart through a reboot or service control action. On next start, the SCM launches the attacker's binary with LocalSystem privileges.
No verified proof-of-concept code is referenced in this article. Refer to the external advisories for technical details of the exploitation primitive.
Detection Methods for CVE-2022-50921
Indicators of Compromise
- Presence of executable files in root directories such as C:\Program.exe or in intermediate path segments of the WOW21 service install location.
- Windows Event Log entries showing service start failures followed by successful starts from unexpected binary locations.
- New service processes spawning from non-standard paths under the services.exe parent.
Detection Strategies
- Audit the registry key HKLM\SYSTEM\CurrentControlSet\Services\<WOW21Service>\ImagePath for values containing spaces without surrounding double quotes.
- Enumerate all services on endpoints and flag those whose BinaryPathName contains an unquoted path with spaces.
- Monitor process creation events (Windows Event ID 4688 or Sysmon Event ID 1) where services.exe spawns binaries from unexpected directories.
Monitoring Recommendations
- Track file creation events in directories that precede service binary locations, particularly C:\ and C:\Program Files\.
- Alert on writes to root volume paths by non-administrative users.
- Correlate service restart events with preceding file write activity from low-privilege accounts.
How to Mitigate CVE-2022-50921
Immediate Actions Required
- Inventory all hosts running WOW21 5.0.1.9 and identify the affected service registration.
- Manually quote the service ImagePath registry value or reinstall using a patched version once available from the vendor.
- Restrict write permissions on C:\ and any intermediate directories that fall along the unquoted service path.
Patch Information
No vendor patch URL is referenced in the available advisory data. The vendor website snapshot is preserved at the Wayback Machine Snapshot. Administrators should contact the vendor directly or remove the affected software where a fix is unavailable.
Workarounds
- Modify the ImagePath registry value to enclose the full binary path in double quotes using sc config or direct registry edit.
- Remove write permissions for non-administrative users on all directories preceding the service binary location.
- Uninstall WOW21 5.0.1.9 from systems where the service is not required for business operations.
# Configuration example: quote an unquoted service ImagePath
sc config "WOW21Service" binPath= "\"C:\Program Files\WOW21\wow21service.exe\""
# Verify the change
sc qc "WOW21Service"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
