Security readout for executives and security teams
Plain-English summary
This flaw can let an unauthenticated attacker determine which usernames are valid in IntelliChoice eFORCE Software Suite. By itself, it does not provide account access, but it can support password guessing, phishing, or targeted attacks against law-enforcement or public-safety users if the system is exposed.
Executive priority
Prioritize if eFORCE is internet-accessible or protects sensitive public-safety workflows. This is not a direct system takeover vulnerability, but it can materially aid account-targeting campaigns. Address through exposure reduction, vendor guidance, and stronger authentication monitoring.
Technical view
CVE-2021-47717 is a CWE-204 username enumeration issue in IntelliChoice eFORCE Software Suite, reported for version 2.5.9.6. The vulnerable behavior is tied to the ctl00$MainContent$UserName POST parameter, where responses can reveal whether a submitted username is valid. CVSS v4.0 is 6.9, network-exploitable, low complexity, no privileges, no user interaction.
Likely exposure
Exposure is most relevant where eFORCE login functionality is reachable from untrusted networks. The source bundle identifies IntelliChoice eFORCE Software Suite 2.5.9.6 as affected. Organizations not running this product, or not exposing its authentication interface, are unlikely to be directly affected.
Exploitation context
A public ExploitDB reference exists, so proof-of-concept details are publicly available. The provided sources do not show CISA KEV listing or confirmed active exploitation. Treat this as a reconnaissance-enabling flaw that may increase risk when combined with weak passwords or exposed login portals.
Researcher notes
Sources identify username enumeration through a specific POST parameter and include a public ExploitDB entry. Avoid assuming broader product versions beyond the cited 2.5.9.6 evidence. No source in the bundle names a patch level, fixed version, or active exploitation.
Mitigation direction
- Identify whether IntelliChoice eFORCE Software Suite 2.5.9.6 is in use.
- Check IntelliChoice or official support channels for update or remediation guidance.
- Restrict external access to eFORCE authentication pages where operationally feasible.
- Enforce strong authentication and password controls for eFORCE users.
- Monitor login and username lookup patterns for abnormal enumeration behavior.
Validation and detection
- Confirm product name and version from asset inventory or administrator interface.
- Determine whether the eFORCE login page is reachable from the internet or partner networks.
- Review authentication logs for repeated username probes or unusual failed login patterns.
- Verify whether vendor remediation or compensating controls have been applied.
- Document any exposed instances for vulnerability management tracking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-204: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47717 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-50164CVE reference · exploit
- Official Product HomepageCVE reference · product
- Zero Science Lab Disclosure (ZSL-2021-5658)CVE reference · third-party-advisory
- VulnCheck Advisory: IntelliChoice eFORCE Software Suite Username EnumerationCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.