CVE-2021-47806
Published: 16 January 2026
Summary
CVE-2021-47806 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Flexense Dup Scout. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2021-47806 is an unquoted service path vulnerability in Dup Scout version 13.5.28. The flaw exists in the Windows service configuration for the executable at 'C:\Program Files\Dup Scout Server\bin\dupscts.exe', where the path lacks proper quoting. This issue, classified under CWE-428, enables local attackers to potentially execute arbitrary code. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-16.
Local attackers with low privileges can exploit the unquoted path by placing malicious executables in intermediate directories along the service path, such as C:\Program.exe, causing the service to execute the attacker's code instead of the legitimate binary upon service startup or restart. Successful exploitation allows privilege escalation, granting high-impact access to confidentiality, integrity, and availability.
Advisories and proof-of-concept exploits are documented in references including https://www.exploit-db.com/exploits/50025 and https://www.vulncheck.com/advisories/dup-scout-multiple-unquoted-service-path, with the vendor site at https://www.dupscout.com. A public exploit confirms practical exploitability in laboratory conditions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3016
Vulnerability details
Dup Scout 13.5.28 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Dup Scout Server\bin\dupscts.exe' to inject malicious executables and escalate…
more
privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path enabling local path interception for privilege escalation via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for services, including proper quoting of executable paths to directly prevent unquoted service path exploitation.
Requires timely remediation of identified flaws, such as patching or fixing the unquoted service path in Dup Scout to eliminate the vulnerability.
Vulnerability scanning specifically identifies unquoted service path issues like CVE-2021-47806 in service configurations before exploitation occurs.