CVE-2021-47829
Published: 16 January 2026
Summary
CVE-2021-47829 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Weird Solutions (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2021-47829 is an unquoted service path vulnerability in DHCP Broadband version 4.1.0.1503. The flaw exists in the service configuration for the executable at 'C:\Program Files\DHCP Broadband 4\dhcpt.exe', where the path lacks proper quotation, enabling local privilege escalation as classified under CWE-428. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local low-privileged attackers can exploit this by placing a malicious executable in an intermediate directory along the unquoted path resolution, such as 'C:\Program Files\DHCP Broadband.exe'. When the service starts, it executes the attacker's binary instead of the legitimate one, granting LocalSystem permissions and allowing arbitrary code execution with high impacts on confidentiality, integrity, and availability.
Advisories from VulnCheck and a proof-of-concept exploit on Exploit-DB (ID 49850) document the issue, with additional details potentially available from the vendor at weird-solutions.com. No specific patches or mitigations are detailed in the provided references.
A public exploit is available on Exploit-DB, highlighting the risk of real-world local privilege escalation in affected DHCP Broadband deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2890
Vulnerability details
DHCP Broadband 4.1.0.1503 contains an unquoted service path vulnerability in its service configuration that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path in 'C:\Program Files\DHCP Broadband 4\dhcpt.exe' to inject malicious code that will…
more
execute during service startup with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by placing a malicious binary in an intermediate directory, executed with LocalSystem privileges on service start.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
CM-6 enforces and documents secure configuration settings for system components, including properly quoting service executable paths to directly prevent unquoted service path exploitation.
AC-6 applies least privilege to service accounts, preventing full privilege escalation even if a malicious binary is executed via the unquoted service path.
RA-5 requires vulnerability scanning that identifies unquoted service path flaws like this CVE before local attackers can exploit them.