Security readout for executives and security teams
Plain-English summary
This is a local privilege-escalation issue in Realtek Wireless LAN Utility 700.1631 on Windows. A low-privileged local user could abuse an unquoted service path for the Realtek11nSU service so attacker-controlled code runs with higher privileges during application startup or reboot. It is not a remote entry point, but it can turn a limited foothold into full system compromise.
Executive priority
Treat as a high-priority endpoint hardening issue, especially where users lack administrative rights but endpoints handle sensitive data. It does not appear to be remotely exploitable by itself, but it can materially worsen an intrusion by enabling privilege escalation after initial access.
Technical view
CVE-2021-47880 is a CWE-428 unquoted service path vulnerability affecting Realtek Wireless LAN Utility 700.1631. The reported service path for Realtek11nSU can be interpreted unsafely by Windows service execution logic. CVSS v4.0 is 8.5, with local attack vector, low complexity, low privileges required, and high confidentiality, integrity, and availability impact on the vulnerable system.
Likely exposure
Exposure is limited to systems with Realtek Wireless LAN Utility version 700.1631 installed and the vulnerable Realtek11nSU service present. This is most relevant to Windows endpoints, laptops, or packaged OEM wireless driver utilities. The supplied sources do not identify other affected Realtek products or versions.
Exploitation context
A public Exploit-DB entry is referenced, so defenders should assume exploit knowledge is public. The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires local low-privileged access and a condition where malicious code can be placed in a path Windows may resolve before the intended executable.
Researcher notes
The record is source-limited: affected version is listed only as Realtek Wireless LAN Utility 700.1631, with no confirmed vendor patch details in the bundle. Public exploit reference exists, but active exploitation is not evidenced. Validate by service configuration and installed version, and avoid broad assumptions about other Realtek wireless packages without vendor confirmation.
Mitigation direction
- Identify endpoints running Realtek Wireless LAN Utility 700.1631.
- Check Realtek or OEM support channels for updated utility or driver packages.
- Remove the utility where wireless management software is not required.
- Correct the service path quoting where approved by vendor or change-management policy.
- Restrict standard users from writing to sensitive root or program paths.
- Prioritize remediation on shared, kiosk, developer, and high-risk user endpoints.
Validation and detection
- Inventory installed Realtek Wireless LAN Utility versions across Windows endpoints.
- Confirm whether the Realtek11nSU service exists on each endpoint.
- Review the service executable path for unquoted paths containing spaces.
- Check whether low-privileged users can write to relevant parent directories.
- Verify remediation by confirming the service path is safely quoted or utility removed.
- Monitor endpoint alerts for suspicious binaries in root or program-adjacent paths.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-428: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47880 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-49646CVE reference · exploit
- Realtek Official HomepageCVE reference · product
- VulnCheck Advisory: Realtek Wireless LAN Utility 700.1631 - 'Realtek11nSU' Unquoted Service PathCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unquoted Search Path or Element
Unquoted Search Path or Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.