CVE-2021-47891

CriticalPublic PoC

Published: 23 January 2026

Published

23 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0025 48.1th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-47891 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Unifiedremote (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and CM-7 (Least Functionality).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

AC-14 directly prohibits permitting critical functions like remote command execution without identification or authentication, addressing the core CWE-306 issue in this service.

CM-7 Least Functionality good match

prevent

CM-7 enforces least functionality by disabling or restricting unnecessary services like Unified Remote on port 9512 that expose RCE risks.

SC-7 Boundary Protection good match

prevent

SC-7 provides boundary protection to monitor and control network traffic to port 9512, blocking unauthorized remote access attempts.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated remote code execution via crafted network packets to a public-facing service on port 9512 directly enables T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands. Attackers can exploit the service by connecting to port 9512 and sending specially crafted packets to open a command…

prompt and download and execute malicious payloads.

Deeper analysisAI

CVE-2021-47891 is a remote code execution vulnerability in Unified Remote version 3.9.0.2463. The issue, linked to CWE-306 (Missing Authentication for Critical Function), allows attackers to send crafted network packets to the service, which listens on TCP port 9512, resulting in the execution of arbitrary commands. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its severe potential impact.

Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. By connecting to port 9512 and transmitting specially crafted packets, they can open a command prompt on the target system and download and execute malicious payloads, achieving full compromise with high confidentiality, integrity, and availability effects.

Reference materials include a proof-of-concept exploit published on Exploit-DB at https://www.exploit-db.com/exploits/49587 and an advisory from VulnCheck at https://www.vulncheck.com/advisories/unified-remote-remote-code-execution. The vendor's site at https://www.unifiedremote.com/ and download page at https://www.unifiedremote.com/download provide additional context, though specific mitigation or patch details are not outlined in the available information.