TotalAV
CVE-2021-47787
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated local access to host
-
DeliveryIdentify unquoted LocalSystem service path
-
ExploitPlant malicious exe in path segment
-
ExecutionTrigger service restart or reboot
-
ImpactBinary executes as SYSTEM
Vulnerability Assessment
| Weakness | |
| Exploitation Conditions | Requires local, interactive access as an already-authenticated low-privileged user (PR:L) on a Windows host running TotalAV 5.15.69, AND that user must have write permission to a directory corresponding to an earlier segment of an affected service's unquoted ImagePath (e.g. C:\ or C:\Program Files\...). Exploitation is not immediate: it depends on the affected LocalSystem service being restarted or the machine rebooting to load the planted executable. Limiting factors: no remote vector (AV:L), no network exposure, and default Windows directory ACLs on C:\ and C:\Program Files often prevent standard users from writing the needed file, which constrains real-world exploitability despite the published PoC. |
| Impact | Signals are consistent and point to a genuine but NOT high-urgency local privilege-escalation issue. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N, VC:H/VI:H/VA:H) correctly characterizes this as a local attack requiring an already-authenticated low-privileged user, with high confidentiality/integrity/availability impact because the service runs as LocalSystem - matching CWE-428 (unquoted service path). Public exploit code exists (Exploit-DB 50314), which raises practicality, but EPSS is effectively nil (0.01%, 0th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. The low EPSS is expected and non-contradictory: unquoted-service-path flaws require pre-existing local access plus write permission to a privileged path segment, so they are post-compromise escalation primitives rather than remotely scannable/wormable targets. Net: a legitimate finding to patch during normal cycles for hosts running TotalAV, but not an emergency - the local-only, authenticated prerequisite caps real-world risk well below what the 8.5 score might suggest to a triager who ignores the attack vector. |
| Exploit ScenarioDerived | A low-privileged but authenticated user on a Windows host running TotalAV 5.15.69 identifies a service whose ImagePath is unquoted and contains spaces (e.g. C:\Program Files\...), then plants a malicious executable at an earlier path segment (e.g. C:\Program.exe). When the affected service restarts or the machine reboots, Windows launches the attacker's binary as LocalSystem. A public proof-of-concept (Exploit-DB 50314) demonstrates the technique, lowering the skill barrier, though exploitation still requires local access and write permission to the hijackable directory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 06, 2026
Local privilege escalation in TotalAV 5.15.69 on Windows is caused by unquoted service paths in multiple LocalSystem services, allowing a local authenticated attacker who can write to an earlier executable-search location to plant a malicious binary and potentially gain SYSTEM-level access when the service restarts or the host reboots. Publicly available exploit code exists (Exploit-DB 50314), but exploitation requires local interactive access, low-privileged credentials, and write permissions that default Windows ACLs often restrict, so real-world urgency is limited; EPSS is 0.01% and there is no CISA KEV confirmation. The independent assessment rates this as a genuine but not high-urgency local privilege-escalation issue.
Earlier versions of this analysis (1)
TotalAV 5.15.69 contains an unquoted service path vulnerability in multiple system services running with LocalSystem privileges. Attackers can place malicious executables in specific unquoted path segments to potentially gain SYSTEM-level access by exploiting the service path configuration. [CVSS 7.8 HIGH]
RemediationAI
No vendor-released patch or fixed version is specified in the provided data; check TotalAV and the VulnCheck advisory for an updated release, and upgrade beyond 5.15.69 if a fixed version becomes available. Where administrative access permits, remediate by quoting the ImagePath value for each affected service in HKLM\SYSTEM\CurrentControlSet\Services\<service>\ImagePath so the full executable path is enclosed in quotation marks. Also restrict write access to directories corresponding to earlier unquoted path segments (for example C:\ and C:\Program Files) so non-administrative users cannot create files such as C:\Program.exe or C:\Program Files\TotalAV.exe; this may affect other applications that rely on write access to those locations, so scope ACL changes narrowly where possible. Additional compensating controls include application whitelisting to block execution of unexpected binaries from those paths, monitoring for new executable files in service path directories and for ImagePath changes, and avoiding granting standard users local interactive logon on hosts running affected TotalAV versions. Service path edits require administrator rights and should be tested because incorrect quoting can prevent services from starting, and exploitation is only triggered on service restart or reboot. Reference: https://www.vulncheck.com/advisories/totalav-unquoted-service-path and https://www.exploit-db.com/exploits/50314.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-428 (Unquoted Search Path or Element) affecting TotalAV 5.15.69 (CPE: cpe:2.3:a:totalav:totalav:5.15.69:*:*:*:*:*:*:*). On Windows, service ImagePath registry values that contain spaces but are not enclosed in quotes are parsed ambiguously by the service control manager; if a path segment such as C:\Program.exe or C:\Program Files\TotalAV.exe is writable, a low-privileged local user can place an executable there. When the affected LocalSystem service starts - typically after a reboot or service restart - Windows may execute the planted file with SYSTEM privileges instead of the intended TotalAV binary. The published VulnCheck advisory and Exploit-DB 50314 demonstrate the class, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this is a local authenticated escalation path, not a remotely exploitable or unauthenticated vector. Default ACLs on C:\ and C:\Program Files frequently prevent standard users from writing the required file, which is the main constraint on exploitability.
Know when Totalav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local authenticated user (AV:L, PR:L) hijacks an unquoted LocalSystem service path with no user interaction, yielding full SYSTEM compromise (C/I/A:H); no scope change as the OS authorization boundary is the target.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
TotalAV 5.15.69 contains an unquoted service path vulnerability in multiple system services running with LocalSystem privileges. Attackers can place malicious executables in specific unquoted path segments to potentially gain SYSTEM-level access by exploiting the service path configuration.
Executive ViewAI
TotalAV 5.15.69 on Windows endpoints contains a local privilege escalation flaw that could allow an attacker with existing local access to gain SYSTEM-level rights. Because publicly available exploit code exists and no vendor-released patch identified at time of analysis, organizations using this version face elevated risk if endpoints are already compromised or have misconfigured permissions. Leadership should prioritize identifying affected endpoints and applying compensating controls until a fix is available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict write permissions to TotalAV service executable directories to administrators, correct unquoted service paths by quoting the full executable path in the Windows registry, enforce least privilege, monitor for new or modified services, and consider application allowlisting on endpoints running TotalAV 5.15.69.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
Insecure Permission vulnerability in TotalAV v.6.0.740 allows a local attacker to escalate privileges via a crafted file
Local privilege escalation in TotalAV versions up to 7.1.17 allows an authenticated but unprivileged local user to imper
An issue was discovered in TotalAV v4.1.7. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
GitHub PoC