CVE-2021-47813
Published: 16 January 2026
Summary
CVE-2021-47813 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsauditor (inferred from references). Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 8.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2021-47813 is a denial-of-service vulnerability in Backup Key Recovery version 2.2.7. The flaw stems from a buffer overflow in the registration code input field, where attackers can crash the application by pasting a large buffer of 256 repeated characters. This issue is classified under CWE-120 (Buffer Copy without Checking Size of Input) and carries a CVSS v3.1 base score of 7.5, reflecting high severity due to its impact on availability.
The vulnerability enables remote attackers with no privileges or user interaction to exploit it over the network with low complexity. Successful exploitation triggers application instability and crash, resulting in a high-impact denial of service (A:H) without affecting confidentiality or integrity.
Advisories and proof-of-concept details are available from sources including NSAuditor, Exploit-DB (exploit 49966), and Vulncheck, which document the denial-of-service PoC for Backup Key Recovery.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3029
Vulnerability details
Backup Key Recovery 2.2.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration code input field. Attackers can paste a large buffer of 256 repeated characters into the registration key field to…
more
trigger application instability and potential crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in registration input directly enables application crash via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of input size and format on the registration code field, blocking the oversized buffer that triggers the CWE-120 overflow and crash.
Requires mechanisms to protect against denial-of-service conditions that degrade availability, directly mitigating the application crash caused by the malicious input.
Mandates memory protection techniques that can contain or block exploitation of unchecked buffer copies, limiting the impact of the 256-character overflow in this application.