CVE-2021-47867
Published: 21 January 2026
Summary
CVE-2021-47867 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Honeywell (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47867 is an unquoted service path vulnerability affecting WIN-PACK PRO4.8, specifically in the ScheduleService component. The issue stems from an unquoted path in the service executable located at 'C:\Program Files <x86>\WINPAKPRO\ScheduleService Service.exe', which allows local privilege escalation. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-428.
Local users with low privileges can exploit this vulnerability by placing a malicious executable in one of the path directories preceding the service binary, such as in C:\Program Files. When the ScheduleService starts, the system may execute the attacker's malicious code instead, granting elevated system privileges. This enables full control over the affected system, including high confidentiality, integrity, and availability impacts.
Advisories and related resources, including those from Exploit-DB (exploit 49691), Honeywell's Winpak product repository, and VulnCheck, provide details on the issue but do not specify patches in the available information. Security practitioners should consult these references for mitigation guidance, such as correcting the service path or restricting service directories.
An exploit is publicly available on Exploit-DB, indicating potential for real-world local privilege escalation attacks on unpatched WIN-PACK PRO4.8 systems.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3619
Vulnerability details
WIN-PACK PRO4.8 contains an unquoted service path vulnerability in the ScheduleService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in 'C:\Program Files <x86>\WINPAKPRO\ScheduleService Service.exe' to inject malicious code that would…
more
execute during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in ScheduleService directly matches Path Interception by Unquoted Path (T1574.009), enabling local privilege escalation via malicious executable placement in preceding directories.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for services, including quoted executable paths, directly preventing exploitation of unquoted service path vulnerabilities like CVE-2021-47867.
Requires identification, reporting, and remediation of flaws such as unquoted service paths, ensuring vulnerabilities like CVE-2021-47867 are corrected before exploitation.
Applies least privilege to services, reducing the impact of privilege escalation even if an unquoted path in CVE-2021-47867 is exploited.