CONTPAQi® AdminPAQ 14.0.0 - Unquoted Service Path | Advisories

Advisories

CONTPAQi® AdminPAQ 14.0.0 - Unquoted Service Path

severity: high
date: January 13, 2026
Affecting: CONTPAQ AdminPAQ 14.0.0
CVE: CVE-2022-50938
CWE: CWE-428 Unquoted Search Path or Element
CVSS: 8.5
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-50690
CONTPAQi Official Software Download Page
Credit: Angel Canseco
Description: CONTPAQi AdminPAQ 14.0.0 contains an unquoted service path vulnerability in the AppKeyLicenseServer service running with LocalSystem privileges. Attackers can exploit the unquoted path to inject malicious code in the service binary path, potentially executing arbitrary code with elevated system privileges during service startup.