CVE-2021-47823
Published: 16 January 2026
Summary
CVE-2021-47823 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Acer (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2021-47823 is an unquoted service path vulnerability affecting Acer ePowerSvc version 6.0.3008.0. The issue stems from an improperly quoted executable path in the Windows service configuration, which permits local users to potentially execute arbitrary code with elevated system privileges. This flaw, classified under CWE-428, enables attackers to inject malicious code that runs with LocalSystem permissions during service startup.
The vulnerability requires local access with low privileges (PR:L), low attack complexity (AC:L), and no user interaction (UI:N), as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A local attacker can exploit the unquoted path by placing a malicious executable in a directory that the service resolves before the legitimate binary, achieving high impacts on confidentiality, integrity, and availability through privilege escalation to LocalSystem.
Advisories, including those from Vulncheck, describe the unquoted path in ePowerSvc.exe, while a proof-of-concept exploit is available on Exploit-DB (ID 49900). Acer's website is referenced for further details, though specific patch or mitigation guidance is not outlined in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2881
Vulnerability details
Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem…
more
permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unquoted service path in Windows service config enables path interception for local privilege escalation to LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates secure configuration settings for services, directly preventing unquoted service path vulnerabilities by ensuring executable paths are properly quoted.
Requires timely identification, reporting, and correction of flaws such as unquoted service paths in Acer ePowerSvc, eliminating the vulnerability through remediation.
Vulnerability scanning detects unquoted service path issues like CVE-2021-47823, enabling proactive remediation before exploitation.