CVE-2021-47810
Published: 16 January 2026
Summary
CVE-2021-47810 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Wibu Wibukey. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 11.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2021-47810, published on 2026-01-16, is an unquoted service path vulnerability in WibuKey Runtime 6.51, affecting the WkSvW32.exe service installed at 'C:\PROGRAM FILES (X86)\WIBUKEY\SERVER\WkSvW32.exe'. This issue, mapped to CWE-428, enables local attackers to potentially execute arbitrary code by exploiting the unquoted path. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
Local low-privileged attackers can exploit the vulnerability by placing malicious executables in intermediate directories along the unquoted service path, causing the system to execute the attacker's binary instead of the legitimate service upon startup. Successful exploitation leads to arbitrary code execution and privilege escalation.
Advisories and resources include a proof-of-concept exploit published on Exploit-DB at https://www.exploit-db.com/exploits/49999. The Vulncheck advisory at https://www.vulncheck.com/advisories/wibukey-runtime-wksvwexe-unquoted-service-path details the flaw. Wibu's support site at https://www.wibu.com/us/support/user/downloads-user-software.html offers software downloads, where users should check for patches or updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3022
Vulnerability details
WibuKey Runtime 6.51 contains an unquoted service path vulnerability in the WkSvW32.exe service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\PROGRAM FILES (X86)\WIBUKEY\SERVER\WkSvW32.exe' to inject malicious executables and escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service directly enables path interception for arbitrary code execution and privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for services, including quoted executable paths, directly preventing exploitation of unquoted service path vulnerabilities like CVE-2021-47810.
Requires identification, reporting, and timely remediation of flaws such as unquoted service paths in WibuKey Runtime, mitigating the vulnerability through patches or configuration corrections.
Implements vulnerability scanning that identifies unquoted service path issues in services like WkSvW32.exe, enabling proactive detection and remediation of CVE-2021-47810.