CVE-2022-50901

High · 7.8

CVSS

7.8

EPSS

0.3%

Published

Jan 13, 2026

CISA due date

—

The record

Wondershare Dr.Fone 11.4.9 contains an unquoted service path vulnerability in the DFWSIDService that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\ to inject malicious executables that would run with LocalSystem privileges.

Affected packages

Ecosystem	Package	Introduced	Fixed