CVE-2021-47861

HighPublic PoC

Published: 21 January 2026

Published

21 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 4.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-47861 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Eventlogxp (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the unquoted service path vulnerability in Event Log Explorer by requiring identification, reporting, and correction of the specific flaw through patching or updates.

CM-6 Configuration Settings good match

prevent

Enforces secure configuration settings for the EloDEAEventCollectorService, including properly quoted executable paths to prevent exploitation via malicious file placement.

AC-6 Least Privilege partial match

prevent

Enforces least privilege for the service account, reducing the impact of arbitrary code execution even if the unquoted path is exploited to run a malicious executable.

NVD Description

Event Log Explorer 4.9.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path by placing malicious executables in specific file system locations that…

will be executed with LocalSystem account privileges during service startup.

Deeper analysisAI

CVE-2021-47861 is an unquoted service path vulnerability in Event Log Explorer version 4.9.3. The issue, classified as CWE-428, affects the service path configuration and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It enables local users to potentially execute arbitrary code with elevated system privileges by exploiting the improperly quoted path during service startup.

Local users with low privileges can exploit this vulnerability by placing malicious executables in specific file system locations targeted by the unquoted service path. Upon service startup, these executables execute under the LocalSystem account, granting attackers high confidentiality, integrity, and availability impacts through arbitrary code execution with system-level privileges.

Advisories, including one from VulnCheck, describe the flaw in the EloDEAEventCollectorService component. A proof-of-concept exploit is publicly available on Exploit-DB (ID 49704). The vendor site, eventlogxp.com, provides additional context on the affected software. No specific patch details are outlined in the provided references.