CVE-2021-47879
Published: 21 January 2026
Summary
CVE-2021-47879 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Server Web (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47879 is an unquoted service path vulnerability in the eBeam Stylus Driver service within eBeam Interactive Suite 3.6. Published on 2026-01-21, it stems from CWE-428 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue arises from an unquoted path specification at C:\Program Files (x86)\Luidia\eBeam Stylus Driver\, enabling local privilege escalation.
A local attacker with low privileges can exploit this vulnerability by placing a malicious executable in a directory that the Windows service control manager resolves before the legitimate binary due to the unquoted path. When the eBeam Stylus Driver service starts or restarts, the injected executable runs with LocalSystem permissions, potentially allowing full system compromise with high impacts on confidentiality, integrity, and availability.
Advisories and related resources include a vendor download page at http://esvc000385.wic045u.server-web.com/Downloads/eBeam/, a proof-of-concept exploit on Exploit-DB at https://www.exploit-db.com/exploits/49648, and a detailed advisory from Vulncheck at https://www.vulncheck.com/advisories/ebeam-interactive-suite-ebeam-stylus-driver-unquoted-service-path. These references provide exploit details but do not specify patch availability in the CVE data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3639
Vulnerability details
eBeam Interactive Suite 3.6 contains an unquoted service path vulnerability in the eBeam Stylus Driver service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Luidia\eBeam Stylus Driver\ to…
more
inject malicious executables that would run with LocalSystem permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service directly enables path interception for privilege escalation via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires organizations to identify, report, and correct system flaws like the unquoted service path in eBeam Stylus Driver, directly preventing exploitation of CVE-2021-47879.
CM-6 mandates secure configuration settings for services, including quoted paths and proper permissions, to eliminate unquoted service path vulnerabilities like this one.
AC-6 enforces least privilege for services, reducing the privilege escalation impact if an unquoted path in eBeam Stylus Driver is exploited.