CVE-2021-47825
Published: 16 January 2026
Summary
CVE-2021-47825 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Acer Updater Service (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47825 is an unquoted service path vulnerability (CWE-428) affecting Acer Updater Service version 1.2.3500.0. The vulnerability stems from an improperly quoted service path at C:\Program Files\Acer\Acer Updater\, which enables local privilege escalation by allowing execution of unintended executables with elevated privileges. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-16.
A local attacker with low privileges can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the unquoted path search order. When the Acer Updater Service starts, the system executes the attacker's payload with LocalSystem permissions, achieving full control over the system including high impacts on confidentiality, integrity, and availability.
Advisories from VulnCheck and an exploit proof-of-concept published on Exploit-DB (ID 49890) provide technical details on the vulnerability, including the affected service executable (UpdaterService.exe). Acer's support page is also referenced, though specific patch or mitigation guidance is not detailed in the CVE record.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2889
Vulnerability details
Acer Updater Service 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code with elevated system privileges. Attackers can exploit the unquoted path in C:\Program Files\Acer\Acer Updater\ to inject malicious executables that will run with LocalSystem…
more
permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception for service binary execution with SYSTEM privileges (T1574.009) and local privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identifying, reporting, and correcting the unquoted service path flaw in Acer Updater Service to prevent local privilege escalation.
Mandates secure configuration settings for system components like services, including properly quoting executable paths to block exploitation of unquoted paths.
Vulnerability scanning identifies misconfigurations such as unquoted service paths in Acer Updater Service for subsequent remediation.