Security readout for executives and security teams
Plain-English summary
Disk Sorter Enterprise 13.6.12 for Windows has a service configuration flaw. A local user with limited privileges may be able to abuse the unquoted service path to run code with higher privileges. This is mainly an internal host risk, not a remote internet-facing flaw.
Executive priority
Prioritize remediation on shared servers, administrator workstations, and systems where low-privileged users can log in. Treat as high priority for internal privilege-escalation risk, especially if Disk Sorter Enterprise runs with elevated service privileges.
Technical view
CVE-2021-47809 is a CWE-428 unquoted service path issue in the Disk Sorter Enterprise Windows service path: C:\Program Files\Disk Sorter Enterprise\bin\disksrs.exe. The CVSS 4.0 vector is local, low complexity, low privileges, no user interaction, with high impact to vulnerable-system confidentiality, integrity, and availability.
Likely exposure
Exposure is limited to Windows systems running Disk Sorter Enterprise 13.6.12 with the vulnerable service configuration. Attackers need local access or a foothold on the host. The provided sources do not identify other affected versions or platforms.
Exploitation context
A public Exploit-DB entry exists, but the source bundle does not show CISA KEV listing or confirmed active exploitation. Successful abuse requires local privileges and a writable path condition suitable for unquoted service path hijacking.
Researcher notes
Evidence is strongest for version 13.6.12. The record cites Exploit-DB and VulnCheck, but no official patch details are included in the provided sources. Avoid assuming remote exploitability or active exploitation without additional evidence.
Mitigation direction
- Inventory Windows hosts for Disk Sorter Enterprise 13.6.12.
- Check vendor guidance for an updated version or official remediation.
- Restrict local user write access near service path locations.
- Apply least privilege to accounts with interactive or local access.
- Monitor service configuration changes and unexpected executables in application paths.
Validation and detection
- Confirm installed Disk Sorter Enterprise version on Windows endpoints.
- Review the Disk Sorter Enterprise service executable path configuration.
- Check whether the service path is properly quoted.
- Assess directory permissions along the service path.
- Look for unexpected binaries in parent application directories.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-428: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47809 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-50014CVE reference · exploit
- Vendor HomepageCVE reference · product
- VulnCheck Advisory: Disk Sorter Enterprise 13.6.12 - 'Disk Sorter Enterprise' Unquoted Service PathCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unquoted Search Path or Element
Unquoted Search Path or Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.