CVE-2021-47884
Published: 21 January 2026
Summary
CVE-2021-47884 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2021-47884 is an unquoted service path vulnerability (CWE-428) affecting the OKI Configuration Tool version 1.6.53, specifically in the OKI Local Port Manager service. The issue stems from the service executable path 'C:\Program Files\Okidata\Common\extend3\portmgrsrv.exe' lacking proper quotation, which can allow local attackers to execute arbitrary code and escalate privileges. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact with low attack complexity.
Local low-privileged attackers can exploit this vulnerability by placing a malicious executable in a directory that the Windows service manager searches due to the unquoted path. Upon service restart or execution, the malicious binary runs with elevated privileges, potentially granting full system compromise on the affected host.
Advisories such as the Vulncheck report on the Configuration Tool OPLCLSRV unquoted service path provide technical details, while Exploit-DB hosts a proof-of-concept exploit (ID 49624). An archived OKI product page references the related Print Job Accounting solution. No patch information is specified in available details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3646
Vulnerability details
OKI Configuration Tool 1.6.53 contains an unquoted service path vulnerability in the OKI Local Port Manager service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Okidata\Common\extend3\portmgrsrv.exe' to inject malicious executables and…
more
escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception by unquoted path (T1574.009) for local privilege escalation via malicious binary placement (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for services, including proper quoting of executable paths to directly prevent unquoted service path vulnerabilities like CVE-2021-47884.
Vulnerability scanning tools specifically detect unquoted service paths in configurations such as the OKI Local Port Manager service, allowing identification and remediation.
Applies least privilege to services, reducing the privileges available for escalation when an unquoted service path is exploited by local attackers.