CVE-2021-47869
Published: 21 January 2026
Summary
CVE-2021-47869 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Unsafe Inline (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and CM-6 (Configuration Settings).
Deeper analysis
Brother BRAdmin Professional 3.75 is affected by CVE-2021-47869, an unquoted service path vulnerability in the BRA_Scheduler service. This flaw, classified under CWE-428, arises because the service path lacks proper quoting, enabling local users to potentially execute arbitrary code. Specifically, attackers can place a malicious executable named 'BRAdmin' in the C:\Program Files (x86)\Brother\ directory, which the service may then invoke with elevated privileges. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local users with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction required. By dropping a malicious 'BRAdmin.exe' into the specified directory, an attacker tricks the BRA_Scheduler service into executing it upon service startup or restart, achieving local system privileges. This grants high-impact confidentiality, integrity, and availability compromises on the affected system.
Advisories from VulnCheck and Exploit-DB detail the issue, with an exploit available at Exploit-DB (ID 49671). Brother provides software downloads via its support site, potentially including patches or updates for remediation, alongside general product resources at global.brother. Security practitioners should consult these references for mitigation guidance, such as applying vendor updates and verifying service paths.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3638
Vulnerability details
Brother BRAdmin Professional 3.75 contains an unquoted service path vulnerability in the BRA_Scheduler service that allows local users to potentially execute arbitrary code. Attackers can place a malicious executable named 'BRAdmin' in the C:\Program Files (x86)\Brother\ directory to gain local…
more
system privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in BRA_Scheduler directly enables path interception by placing a malicious executable in the expected directory for execution with elevated privileges.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path flaw in BRA_Scheduler by applying vendor patches or updates to eliminate the vulnerability.
Enforces secure configuration settings for services, including properly quoted executable paths, to prevent path hijacking exploitation.
Prohibits or restricts user-installed software, preventing low-privileged local users from placing malicious executables in the service's search path directory.