CVE-2021-47985: Brother SAPSprint 7.60 Unquoted Service Path Privilege Escalation
Brother SAPSprint 7.60 contains an unquoted service path vulnerability in the SAPSprint service binary that allows local attackers to escalate privileges. Attackers can place a malicious executable in the Program Files directory path to be executed with LocalSystem privileges when the service starts automatically.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Brother SAPSprint 7.60from your environment.Uninstall Brother SAPSprint 7.60 or remove the SAPSprint service if the software is not required to eliminate the vulnerable service binary.
- Configuration
Update the SAPSprint service ImagePath so the full path to the executable is enclosed in double quotes (e.g., "C:\Program Files\...\sapsprint.exe") to eliminate the unquoted service path vulnerability.
Brother SAPSprint service (SAPSprint 7.60) service ImagePath quoting = enclose the full service executable path in quotes - Compensating control
Restrict write permissions to Program Files directories and any directories in the SAPSprint service path so unprivileged users cannot place executables there; limit who can install or modify services.
- Operational
Inspect the Program Files path(s) referenced by the SAPSprint service for any unauthorized or malicious executables, remove any found, and replace the service binary from a trusted source before restoring the service.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47985?
CVE-2021-47985 has a high severity score of 8.5.
How do I fix CVE-2021-47985?
To fix CVE-2021-47985, ensure the service path for SAPSprint is correctly quoted to prevent privilege escalation.
What kind of vulnerability is CVE-2021-47985?
CVE-2021-47985 is an unquoted service path vulnerability that allows local privilege escalation.
Who is affected by CVE-2021-47985?
Individuals and organizations using Brother SAPSprint version 7.60 are affected by CVE-2021-47985.
Can CVE-2021-47985 be exploited remotely?
CVE-2021-47985 cannot be exploited remotely as it requires local access to the system.