CVE-2021-47787

HighCVSS 7.8/10Last modified Oct 6, 2026

Description

TotalAV 5.15.69 contains an unquoted service path vulnerability in multiple system services running with LocalSystem privileges. Attackers can place malicious executables in specific unquoted path segments to potentially gain SYSTEM-level access by exploiting the service path configuration.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published: Jan 16, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-477888.8WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to exe CVE-2021-477897.5Yenkee Hornet Gaming Mouse driver GM312Fltr.sys contains a buffer overrun vulnerability that allows attackers to crash the system by sending CVE-2021-477907.8Active WebCam 11.5 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated syste CVE-2021-477917.5SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specif CVE-2021-477927.8Remote Mouse 4.002 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated syste CVE-2021-477937.5Telegram Desktop 2.9.2 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized mes CVE-2021-477948.8ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shel CVE-2021-477956.2GeoVision GeoWebServer 5.3.3 contains multiple vulnerabilities including local file inclusion, cross-site scripting, and remote code executi CVE-2021-477968.7Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentica CVE-2021-477977.5Leawo Prof. Media 11.0.0.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversiz CVE-2021-477989.8NoteBurner 2.35 contains a buffer overflow vulnerability in the license code input field that allows attackers to crash the application. Att CVE-2021-477996.2Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to