CVE-2021-47828: BOOTP Turbo Privilege Escalation Flaw

CVE-2021-47828 Overview

CVE-2021-47828 is an unquoted service path vulnerability affecting BOOTP Turbo version 2.0.0.1253. The vulnerability exists in the Windows service configuration where the service executable path contains spaces but is not properly enclosed in quotation marks. This misconfiguration allows local attackers to exploit the Windows service path resolution mechanism to execute arbitrary code with elevated LocalSystem privileges during system startup or reboot.

Critical Impact

Local attackers with write access to specific directories in the service path can achieve privilege escalation to LocalSystem, the highest privilege level on Windows systems, enabling complete system compromise.

Affected Products

• BOOTP Turbo 2.0.0.1253
• Windows installations with BOOTP Turbo service configured

Discovery Timeline

• 2026-01-16 - CVE CVE-2021-47828 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2021-47828

Vulnerability Analysis

This vulnerability is classified as CWE-428 (Unquoted Search Path or Element), a common Windows privilege escalation vector. When a Windows service is configured with an executable path containing spaces that is not enclosed in quotation marks, the Windows Service Control Manager (SCM) interprets the path ambiguously. Windows attempts to resolve the path by progressively adding .exe to each space-delimited segment until it finds a valid executable.

For instance, if the BOOTP Turbo service is installed in a path like C:\Program Files\Weird Solutions\BOOTP Turbo\bootpt.exe, Windows will attempt to execute files in the following order:

1. C:\Program.exe
2. C:\Program Files\Weird.exe
3. C:\Program Files\Weird Solutions\BOOTP.exe
4. C:\Program Files\Weird Solutions\BOOTP Turbo\bootpt.exe

An attacker who can place a malicious executable at any of these intermediate locations can hijack the service execution flow.

Root Cause

The root cause is improper service registration during BOOTP Turbo installation. The installer fails to wrap the service binary path in quotation marks when registering the service with the Windows Service Control Manager. This oversight creates an exploitable condition where the path containing spaces becomes ambiguous to the Windows path resolution algorithm.

Attack Vector

The attack vector requires local access to the target system. An attacker must have write permissions to a directory that appears in the path before the legitimate executable location. In environments where users have write access to directories like C:\Program Files\Weird Solutions\ or its parent directories, an attacker can place a malicious executable (e.g., BOOTP.exe) that will be executed with LocalSystem privileges when the service starts.

The attack is triggered during system startup, service restart, or when an administrator manually starts the service. Since Windows services often run with LocalSystem privileges, successful exploitation grants the attacker complete control over the affected system, including the ability to access all local resources, modify system configurations, and potentially pivot to other network systems.

Detection Methods for CVE-2021-47828

Indicators of Compromise

• Unexpected executable files in parent directories of the BOOTP Turbo installation path (e.g., Program.exe, Weird.exe, or BOOTP.exe in intermediate directories)
• Unusual process execution chains where services.exe spawns unexpected executables during service startup
• Modified file timestamps or newly created files in C:\Program Files\ or C:\Program Files\Weird Solutions\ directories

Detection Strategies

• Query Windows services for unquoted paths using PowerShell: Get-WmiObject Win32_Service | Where-Object {$_.PathName -like '* *' -and $_.PathName -notlike '"*'}
• Monitor file creation events in directories along the service path hierarchy using Windows Event Logging or EDR solutions
• Implement application whitelisting to detect and block execution of unauthorized executables in sensitive directories

Monitoring Recommendations

• Enable Windows Security Event logging for process creation (Event ID 4688) with command line auditing to track service-related process spawning
• Deploy file integrity monitoring on directories within the BOOTP Turbo service path to detect unauthorized file placement
• Use SentinelOne's Behavioral AI to detect anomalous process execution patterns associated with service path hijacking attacks

How to Mitigate CVE-2021-47828

Immediate Actions Required

• Manually correct the service path by enclosing the executable path in quotation marks using the sc config command or registry editor
• Review directory permissions along the service path and restrict write access to administrators only
• Audit other installed services for similar unquoted path vulnerabilities using automated scanning tools

Patch Information

No official vendor patch has been identified for this vulnerability. Administrators should apply the manual remediation steps to correct the service configuration. For additional technical details, refer to the VulnCheck Security Advisory and Exploit-DB #49851.

Workarounds

• Manually add quotation marks around the service ImagePath in the Windows Registry at HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\ImagePath
• Remove write permissions from non-administrative users for all directories in the service path hierarchy
• Consider uninstalling BOOTP Turbo if not actively required, or replace it with an alternative solution that does not contain this vulnerability
• Implement application control policies to prevent execution of unauthorized binaries in the affected directories

# Configuration example - Fix unquoted service path
sc config "BOOTPTurbo" binPath= "\"C:\Program Files\Weird Solutions\BOOTP Turbo\bootpt.exe\""