Security readout for executives and security teams
Plain-English summary
CVE-2021-47867 is a local privilege-escalation issue in WIN-PAK PRO 4.8. A misconfigured Windows service path can allow a local user to run code with elevated system privileges when the service starts. This matters most on shared workstations, servers with remote logon access, or access-control environments where local compromise could affect security operations.
Executive priority
Prioritize remediation for WIN-PAK PRO 4.8 systems that manage physical security or allow multiple local users. This is not described as remotely exploitable, but it can turn a low-privileged foothold into full system control on an important operational host.
Technical view
WIN-PAK PRO 4.8 ScheduleService has an unquoted service path weakness, classified as CWE-428. The referenced path contains spaces and can be abused by a local, low-privileged user to influence execution during service startup. CVSS v4.0 is 8.5, with local attack vector, low complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to systems running WIN-PAK PRO 4.8 with the vulnerable ScheduleService configuration. The attacker needs local access or an already-compromised account on the Windows host. Internet exposure alone is not the primary risk signal for this CVE.
Exploitation context
A public Exploit-DB entry is referenced, but the provided sources do not show CISA KEV listing or confirmed active exploitation. Treat this as a credible local escalation risk, especially if adversaries can obtain standard user access to the host.
Researcher notes
Evidence supports a local Windows unquoted service path vulnerability in ScheduleService. Sources provide severity and public exploit reference, but not confirmed in-the-wild exploitation or a named patch. Validation should focus on actual installed service configuration, local permissions, and whether Honeywell has current product guidance.
Mitigation direction
- Check Honeywell WIN-PAK guidance for supported updates or configuration fixes.
- If vendor-approved, correct the service path so the executable path is properly quoted.
- Restrict local logon, RDP, and administrative access to WIN-PAK hosts.
- Review write permissions on service path parent directories.
- Prioritize hardening on systems managing physical access-control functions.
Validation and detection
- Inventory hosts running WIN-PAK PRO 4.8.
- Inspect ScheduleService configuration for an unquoted executable path.
- Confirm low-privileged users cannot write to relevant parent directories.
- Review service restart events and unexpected file creation near the service path.
- Document compensating controls where vendor remediation is unavailable.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-428: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47867 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-49691CVE reference · exploit
- Honeywell Product WebpageCVE reference · product
- VulnCheck Advisory: WIN-PACK PRO 4.8 - 'ScheduleService' Unquoted Service PathCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unquoted Search Path or Element
Unquoted Search Path or Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.