CVE-2021-47790
Published: 16 January 2026
Summary
CVE-2021-47790 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Pysoft Active Webcam. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 10.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47790 is an unquoted service path vulnerability in Active WebCam 11.5. This flaw stems from a misconfigured service path (CWE-428), enabling local attackers to execute arbitrary code with elevated system privileges by placing malicious executables in specific directory locations along the search path.
The vulnerability can be exploited by local attackers who already possess low privileges (PR:L), requiring low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants administrative access, with high impacts on confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Advisories from VulnCheck (https://www.vulncheck.com/advisories/active-webcam-unquoted-service-path) and an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/50273) document the issue, while the vendor site (https://www.pysoft.com/) and download pages like TechSpot (https://www.techspot.com/downloads/175-active-webcam.html) provide context on the affected software; no specific patches or mitigations are detailed in the referenced materials.
A public proof-of-concept exploit is available on Exploit-DB, indicating potential for real-world local privilege escalation on unpatched systems.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3021
Vulnerability details
Active WebCam 11.5 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the misconfigured service path by placing malicious executables in specific directory locations to gain administrative access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path for local privilege escalation via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for system services, directly preventing unquoted service path vulnerabilities by requiring properly quoted executable paths.
Requires timely identification, reporting, and remediation of flaws like the unquoted service path in Active WebCam 11.5 to eliminate the vulnerability.
Applies least privilege to services, reducing the impact of privilege escalation even if an attacker exploits the unquoted service path.