CVE-2021-47804
Published: 16 January 2026
Summary
CVE-2021-47804 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wisecleaner (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47804 is an unquoted service path vulnerability affecting Wise Care 365 version 5.6.7.568, specifically in the WiseBootAssistant service that runs with LocalSystem privileges. This flaw, classified under CWE-428, allows the service binary path to be unquoted, enabling path hijacking. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
A local attacker with low privileges can exploit this by placing a malicious executable in a directory along the service's search path, ahead of the legitimate WiseBootAssistant binary. When the service restarts—such as during system boot or manual restart—the malicious executable executes with elevated LocalSystem privileges, potentially granting full system compromise.
Advisories and resources include an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/50038) and a detailed advisory from Vulncheck (https://www.vulncheck.com/advisories/wise-care-wisebootassistant-unquoted-service-path). The vendor's Wise Care 365 page (https://www.wisecleaner.com/wise-care-365.html) should be checked for patches or updates to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3023
Vulnerability details
Wise Care 365 5.6.7.568 contains an unquoted service path vulnerability in the WiseBootAssistant service running with LocalSystem privileges. Attackers can exploit this by inserting a malicious executable in the service path, which will execute with elevated system privileges when the…
more
service restarts.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in LocalSystem service directly enables path interception by unquoted path (T1574.009) for privilege escalation via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the unquoted service path flaw through patching or configuration fixes to prevent exploitation.
Enforces secure configuration settings for services, including properly quoted executable paths, to block path hijacking attacks.
Limits damage from service hijacking by requiring the WiseBootAssistant service to run with least privilege rather than LocalSystem.