CVE-2021-47828
Published: 16 January 2026
Summary
CVE-2021-47828 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Weird Solutions (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 3.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47828 is an unquoted service path vulnerability affecting BOOTP Turbo version 2.0.0.1253 in its Windows service configuration. This flaw, classified under CWE-428, allows the service executable path to be unquoted, enabling potential hijacking by malicious files placed in specific directories. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H), indicating high impact with low complexity for local exploitation.
A local attacker with low privileges can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system PATH search order. During system startup or reboot, when the BOOTP Turbo service attempts to launch, the attacker's executable runs instead with elevated LocalSystem privileges, allowing arbitrary code execution, full system compromise, and potential persistence.
Advisories and related resources, including an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/49851) and a detailed analysis from VulnCheck (https://www.vulncheck.com/advisories/bootp-turbo-bootptexe-unquoted-service-path), document the issue, with additional context available from the vendor site at https://www.weird-solutions.com. No specific patch details are outlined in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2887
Vulnerability details
BOOTP Turbo 2.0.0.1253 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path to execute arbitrary code with elevated LocalSystem privileges during system startup or reboot.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path hijacking for local privilege escalation via malicious executable placement in PATH.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the unquoted service path flaw in BOOTP Turbo through patching or configuration fixes to prevent local privilege escalation.
Mandates secure configuration settings for system components, including quoting Windows service executable paths to block PATH-based hijacking exploits.
Restricts systems to least functionality by disabling or removing unnecessary services like vulnerable BOOTP Turbo, eliminating the attack vector.