CVE-2021-47898
Published: 23 January 2026
Summary
CVE-2021-47898 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Com (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47898 is an unquoted service path vulnerability in Epson USB Display version 1.6.0.0, affecting the EMP_UDSA service that runs with LocalSystem privileges. This flaw, mapped to CWE-428, arises from the service binary path not being properly quoted, enabling attackers to exploit intermediate directories in the path.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction (UI:N), requiring only local access (AV:L). By placing a malicious executable in an intermediate directory along the unquoted service path, the attacker can achieve privilege escalation to LocalSystem, resulting in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS 3.1 base score of 7.8.
References include a proof-of-concept exploit published on Exploit-DB (ID 49548), a Vulncheck advisory detailing the Epson USB Display unquoted service path issue, and Epson's Mexican website, though specific mitigation or patch details from these sources are not outlined in available data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4289
Vulnerability details
Epson USB Display 1.6.0.0 contains an unquoted service path vulnerability in the EMP_UDSA service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in intermediate directories to gain elevated system access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in LocalSystem service directly enables path interception for privilege escalation via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for services, including properly quoted executable paths and restrictive permissions on intermediate directories to directly prevent unquoted service path exploitation.
Requires periodic vulnerability scanning and timely remediation of flaws like the unquoted path in the EMP_UDSA service running with LocalSystem privileges.
Limits system functionality by disabling or restricting unnecessary services such as Epson USB Display, preventing the vulnerable service from running if not essential.