CVE-2021-47866
Published: 21 January 2026
Summary
CVE-2021-47866 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Honeywell (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2021-47866 is an unquoted service path vulnerability (CWE-428) affecting WIN-PACK PRO 4.8, specifically in the GuardTourService component. The issue stems from an unquoted path in the service binary located at C:\Program Files <x86>\WINPAKPRO\WP GuardTour Service.exe, which allows local privilege escalation. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact with low attack complexity.
Local users with low privileges can exploit this vulnerability by placing a malicious executable in a directory that precedes "Program Files <x86>" in the system PATH resolution order. When the GuardTourService starts, the system attempts to execute the malicious binary instead, running it with elevated SYSTEM privileges. This enables arbitrary code execution, potentially leading to full system compromise.
Advisories and related resources, including an exploit PoC at https://www.exploit-db.com/exploits/49690, Honeywell's product repository at https://www.security.honeywell.com/product-repository/winpak, and a VulnCheck advisory at https://www.vulncheck.com/advisories/win-pack-pro-guardtourservice-unquoted-service-path, provide further details on the issue. Practitioners should consult these for mitigation guidance, such as correcting the service path configuration.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3625
Vulnerability details
WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in C:\Program Files <x86>\WINPAKPRO\WP GuardTour Service.exe to inject malicious code…
more
that would execute during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping from unquoted service path (CWE-428) to path interception by unquoted path for local privilege escalation to SYSTEM.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and correction of flaws like the unquoted service path in GuardTourService to eliminate the privilege escalation vulnerability.
Enforces secure configuration settings for system components, including quoting service executable paths to prevent hijacking via unquoted paths.
Restricts execution to authorized software programs only, blocking malicious executables placed to exploit the unquoted service path from running with elevated privileges.