PT-2026-2399 · Cobian · Cobian Backup

Hejap Zairy · Publicado 2026-01-13 · Atualizado 2026-03-02 · CVE-2022-50923

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cobian Backup version 0.9

Description A local user can execute arbitrary code with elevated system privileges. This is due to an unquoted service path in the CobianReflectorService, allowing attackers to inject malicious code that executes with LocalSystem permissions during service startup.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider modifying the service path to include quotes to prevent malicious code execution.

Exploit

Correção

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

CVE-2022-50923

Produtos afetados

Cobian Backup

Referências · 9

• 🔥 https://exploit-db.com/exploits/50810 · Exploit
• https://t.me/cveNotify/153573 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2011759608944083420 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2022-50923 · Nota de Segurança
• https://t.me/cveNotify/153749 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-50923 · Aviso do Fabricante
• https://cobiansoft.com/download.php · Nota
• https://vulncheck.com/advisories/cobian-backup-unquoted-service-path · Nota
• https://cobiansoft.com · Nota