CVE-2021-47861
Published: 21 January 2026
Summary
CVE-2021-47861 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Eventlogxp (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47861 is an unquoted service path vulnerability in Event Log Explorer version 4.9.3. The issue, classified as CWE-428, affects the service path configuration and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It enables local users to potentially execute arbitrary code with elevated system privileges by exploiting the improperly quoted path during service startup.
Local users with low privileges can exploit this vulnerability by placing malicious executables in specific file system locations targeted by the unquoted service path. Upon service startup, these executables execute under the LocalSystem account, granting attackers high confidentiality, integrity, and availability impacts through arbitrary code execution with system-level privileges.
Advisories, including one from VulnCheck, describe the flaw in the EloDEAEventCollectorService component. A proof-of-concept exploit is publicly available on Exploit-DB (ID 49704). The vendor site, eventlogxp.com, provides additional context on the affected software. No specific patch details are outlined in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3635
Vulnerability details
Event Log Explorer 4.9.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path by placing malicious executables in specific file system locations that…
more
will be executed with LocalSystem account privileges during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to unquoted service path (CWE-428) enabling path interception for local privilege escalation via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path vulnerability in Event Log Explorer by requiring identification, reporting, and correction of the specific flaw through patching or updates.
Enforces secure configuration settings for the EloDEAEventCollectorService, including properly quoted executable paths to prevent exploitation via malicious file placement.
Enforces least privilege for the service account, reducing the impact of arbitrary code execution even if the unquoted path is exploited to run a malicious executable.