CVE-2021-47868
Published: 21 January 2026
Summary
CVE-2021-47868 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Honeywell (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2021-47868 is an unquoted service path vulnerability affecting WIN-PACK PRO 4.8, specifically in the WPCommandFileService component. The issue stems from the service executable path "C:\Program Files <x86>\WINPAKPRO\WPCommandFileService Service.exe," which lacks proper quoting, enabling potential code execution with elevated privileges. This flaw is classified under CWE-428 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H), indicating high impact on confidentiality, integrity, and availability.
Local users with low privileges can exploit this vulnerability by placing a malicious executable in an intermediate directory along the unquoted path, such as within the C:\Program Files (x86) hierarchy. Upon service restart or system boot, the malicious code executes with LocalSystem permissions, allowing full system compromise including arbitrary code execution, data access, and persistence.
Advisories from Vulncheck detail the unquoted service path issue and recommend applying vendor patches, while Honeywell's product repository for Winpak provides updates for mitigation. An exploit is publicly available on Exploit-DB (ID 49692), demonstrating practical exploitation.
A proof-of-concept exploit has been published, highlighting active interest, though no widespread real-world exploitation in the wild is confirmed in available data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3622
Vulnerability details
WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files <x86>\WINPAKPRO\WPCommandFileService Service.exe to inject malicious code that would…
more
execute with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service executable directly matches Path Interception by Unquoted Path, enabling local low-privileged users to hijack execution for SYSTEM-level code execution on service start.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires identification, reporting, and timely remediation of flaws like CVE-2021-47868 via vendor patches that fix the unquoted service path in WPCommandFileService.
CM-6 enforces secure configuration settings for system components, including proper quoting of Windows service executable paths to prevent hijacking via unquoted paths.
RA-5 uses vulnerability scanning to detect unquoted service path issues like CVE-2021-47868 in WPCommandFileService for subsequent remediation.