CVE-2021-47893
Published: 23 January 2026
Summary
CVE-2021-47893 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Agatasoft (inferred from references). Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).
Deeper analysis
CVE-2021-47893 is a denial-of-service vulnerability in AgataSoft PingMaster Pro version 2.1, specifically affecting the Trace Route feature. The flaw allows attackers to crash the application by overflowing the host name input field with a specially crafted 10,000-character buffer, leading to application termination and potential system instability. It is classified under CWE-770 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its impact on availability.
The vulnerability can be exploited by any remote attacker with network access to a target running the affected software, requiring no privileges, low complexity, and no user interaction. Successful exploitation triggers an application crash, disrupting network diagnostics and potentially causing broader system instability on the victim's machine.
Advisories and references include the vendor site at http://agatasoft.com/, an exploit proof-of-concept at https://www.exploit-db.com/exploits/49567, and a detailed advisory from VulnCheck at https://www.vulncheck.com/advisories/agatasoft-pingmaster-pro-denial-of-service, which document the issue and reproduction steps. No patches or specific mitigations are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4292
Vulnerability details
AgataSoft PingMaster Pro 2.1 contains a denial of service vulnerability in the Trace Route feature that allows attackers to crash the application by overflowing the host name input field. Attackers can generate a 10,000-character buffer and paste it into the…
more
host name field to trigger an application crash and potential system instability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in input field directly enables application crash via exploitation, matching Endpoint DoS by Application or System Exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates hostname input in the Trace Route feature to reject oversized 10,000-character buffers that trigger application crashes.
Restricts the quantity and type of input allowed in the hostname field to prevent buffer overflows leading to denial-of-service.
Mitigates denial-of-service attacks like application crashes from malformed hostname inputs via resource exhaustion protections.