CVE-2022-50915
📋 TL;DR
CVE-2022-50915 is an unquoted service path vulnerability in PTPublisher's PTProtect service that allows local attackers to execute arbitrary code with SYSTEM privileges by placing malicious executables in the unquoted path. This affects users running PTPublisher 2.3.4 on Windows systems where attackers have local access. The vulnerability enables privilege escalation from a lower-privileged user account to full system control.
💻 Affected Systems
- Primera Technology PTPublisher
📦 What is this software?
Ptpublisher by Primera
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with persistent backdoor installation, data theft, ransomware deployment, and complete control over the affected system.
Likely Case
Local privilege escalation leading to lateral movement within the network, credential harvesting, and installation of additional malware.
If Mitigated
Limited impact due to restricted local access, proper endpoint protection, and service hardening preventing successful exploitation.
🎯 Exploit Status
Exploit requires local access but is simple to execute. Public exploit code exists on Exploit-DB (ID 50885).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.5 or later
Vendor Advisory: https://www.primera.com/
Restart Required: Yes
Instructions:
1. Download latest PTPublisher version from Primera Technology website. 2. Uninstall current version. 3. Install updated version. 4. Restart system to ensure service updates apply.
🔧 Temporary Workarounds
Service Path Quoting
windowsManually modify the service configuration to use quoted paths in the service executable path
sc config PTProtect binPath= "\"C:\Program Files (x86)\Primera Technology\PTPublisher\UsbFlashDongleService.exe\""
Service Removal
windowsRemove or disable the vulnerable PTProtect service if not required
sc stop PTProtect
sc delete PTProtect
🧯 If You Can't Patch
- Restrict local access to systems running PTPublisher through strict access controls and privilege management
- Implement application whitelisting to prevent execution of unauthorized binaries in vulnerable directories
🔍 How to Verify
Check if Vulnerable:
Check service configuration: sc qc PTProtect and look for unquoted path containing spaces in 'C:\Program Files (x86)\Primera Technology\PTPublisher\UsbFlashDongleService.exe'Check Version:
Check PTPublisher About dialog or installed programs list for version numberVerify Fix Applied:
Verify service path is quoted: sc qc PTProtect should show path enclosed in quotes. Check PTPublisher version is 2.3.5 or higher.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs: Service Control Manager events for PTProtect service modifications
- Process creation from unusual locations in 'C:\Program Files (x86)\Primera Technology\PTPublisher' directory
Network Indicators:
- Unusual outbound connections from system processes following local privilege escalation
SIEM Query:
EventID=7045 OR (ProcessCreation AND ImagePath CONTAINS 'Primera Technology' AND NOT ImagePath CONTAINS 'UsbFlashDongleService.exe')