CVE-2021-47891
Published: 23 January 2026
Summary
CVE-2021-47891 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Unifiedremote (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and CM-7 (Least Functionality).
Deeper analysis
CVE-2021-47891 is a remote code execution vulnerability in Unified Remote version 3.9.0.2463. The issue, linked to CWE-306 (Missing Authentication for Critical Function), allows attackers to send crafted network packets to the service, which listens on TCP port 9512, resulting in the execution of arbitrary commands. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its severe potential impact.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. By connecting to port 9512 and transmitting specially crafted packets, they can open a command prompt on the target system and download and execute malicious payloads, achieving full compromise with high confidentiality, integrity, and availability effects.
Reference materials include a proof-of-concept exploit published on Exploit-DB at https://www.exploit-db.com/exploits/49587 and an advisory from VulnCheck at https://www.vulncheck.com/advisories/unified-remote-remote-code-execution. The vendor's site at https://www.unifiedremote.com/ and download page at https://www.unifiedremote.com/download provide additional context, though specific mitigation or patch details are not outlined in the available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4286
Vulnerability details
Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands. Attackers can exploit the service by connecting to port 9512 and sending specially crafted packets to open a command…
more
prompt and download and execute malicious payloads.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote code execution via crafted network packets to a public-facing service on port 9512 directly enables T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 directly prohibits permitting critical functions like remote command execution without identification or authentication, addressing the core CWE-306 issue in this service.
CM-7 enforces least functionality by disabling or restricting unnecessary services like Unified Remote on port 9512 that expose RCE risks.
SC-7 provides boundary protection to monitor and control network traffic to port 9512, blocking unauthorized remote access attempts.