CVE-2021-47767
Published: 15 January 2026
Summary
CVE-2021-47767 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in 10-Strike Network Inventory Explorer. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the unquoted service path flaw in srvInventoryWebServer to prevent privilege escalation exploitation.
Mandates secure configuration settings, including properly quoting the srvInventoryWebServer executable path to block hijacking via unquoted segments.
Enforces least privilege for high-privilege services like srvInventoryWebServer running as LocalSystem, reducing the impact of successful unquoted path exploitation.
NVD Description
10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path segments to achieve privilege escalation and execute…
more
code with system-level permissions.
Deeper analysisAI
CVE-2021-47767 is an unquoted service path vulnerability in 10-Strike Network Inventory Explorer Pro version 9.31, affecting the srvInventoryWebServer service that runs with LocalSystem privileges. This flaw, mapped to CWE-428, allows exploitation due to the service executable path not being properly quoted, enabling attackers to hijack the service launch process.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required. By placing a malicious executable in one of the potential unquoted path segments, the attacker achieves privilege escalation, resulting in arbitrary code execution with system-level permissions. The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high impacts on confidentiality, integrity, and availability.
References include the vendor site at https://www.10-strike.com/ and a proof-of-concept exploit documented at https://www.exploit-db.com/exploits/50494, which may provide further details on exploitation and potential mitigations such as updating the software or applying service path fixes. The CVE was published on 2026-01-15.
Details
- CWE(s)