Cyber Resilience

CVE-2021-47826

HighPublic PoC

Published: 16 January 2026

Published
16 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0015 4.5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2021-47826 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Acer Backup Manager (inferred from references). Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings).

Deeper analysis

CVE-2021-47826 is an unquoted service path vulnerability affecting Acer Backup Manager version 3.0.0.99, specifically in the NTI IScheduleSvc service. The flaw, classified under CWE-428, stems from an improperly quoted executable path registered as "C:\Program Files (x86)\NTI\Acer Backup Manager\", enabling potential arbitrary code execution. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact with local access.

Local users with low privileges can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's PATH search order, such as within C:\Program Files (x86)\NTI\. Upon service restart or system boot, the injected executable runs with elevated LocalSystem privileges, granting attackers high confidentiality, integrity, and availability impacts.

Advisories and references, including those from VulnCheck and Exploit-DB, document the unquoted path issue in the IScheduleSvc.exe module, with a proof-of-concept exploit available at https://www.exploit-db.com/exploits/49889. Additional details can be found at https://www.vulncheck.com/advisories/acer-backup-manager-module-ischedulesvcexe-unquoted-service-path and Acer's support site at https://www.acer.com/ac/en/US/content/home; no specific patch details are outlined in the provided information.

EU & UK References

Vulnerability details

Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\NTI\Acer Backup Manager\ to inject malicious executables…

more

that would run with elevated LocalSystem privileges.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1574.009 Path Interception by Unquoted Path Stealth
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Why these techniques?

Unquoted service path in Windows service directly enables path interception for privilege escalation by allowing malicious executable placement in PATH search order.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-36928Shared CWE-428
CVE-2023-54336Shared CWE-428
CVE-2020-37048Shared CWE-428
CVE-2019-25306Shared CWE-428
CVE-2020-36979Shared CWE-428
CVE-2020-36929Shared CWE-428
CVE-2020-37017Shared CWE-428
CVE-2021-47859Shared CWE-428
CVE-2019-25309Shared CWE-428
CVE-2021-47790Shared CWE-428

Affected Assets

Acer
Backup Manager
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces secure configuration settings for services, including proper quoting of executable paths with spaces to directly prevent unquoted service path exploitation.

prevent

Requires timely identification, prioritization, and correction of the specific unquoted service path flaw in Acer Backup Manager's NTI IScheduleSvc.

prevent

Implements application whitelisting with deny-all, permit-by-exception policy to block execution of unauthorized malicious executables placed in intermediate directories.

References