CVE-2021-47869: Brother BRAdmin Privilege Escalation Flaw

CVE-2021-47869 Overview

Brother BRAdmin Professional 3.75 contains an unquoted service path vulnerability in the BRA_Scheduler service that allows local users to potentially execute arbitrary code. Attackers can place a malicious executable named 'BRAdmin' in the C:\Program Files (x86)\Brother\ directory to gain local system privileges. This vulnerability is classified under CWE-428 (Unquoted Search Path or Element).

Critical Impact

Local attackers with write access to the Brother installation directory can achieve privilege escalation to SYSTEM-level access by exploiting the unquoted service path in the BRA_Scheduler service.

Affected Products

• Brother BRAdmin Professional 3.75
• BRA_Scheduler Windows Service
• Brother printer management software installations with default configurations

Discovery Timeline

• 2026-01-21 - CVE CVE-2021-47869 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2021-47869

Vulnerability Analysis

The vulnerability exists because the BRA_Scheduler service in Brother BRAdmin Professional 3.75 is configured with an unquoted service path. When Windows services are installed with paths containing spaces that are not enclosed in quotation marks, the operating system's path parsing behavior can be exploited. The service path C:\Program Files (x86)\Brother\BRAdmin Professional 3\braschedu.exe contains spaces but lacks proper quoting, creating an exploitable condition.

When the service starts, Windows attempts to locate the executable by parsing the path from left to right, testing each space-delimited segment. This means Windows will first attempt to execute C:\Program.exe, then C:\Program Files.exe, then C:\Program Files (x86)\Brother\BRAdmin.exe before finally reaching the intended executable path. An attacker who can write to any of these intermediate paths can hijack the service execution.

Root Cause

The root cause is improper service installation that fails to quote the executable path in the Windows Service Control Manager configuration. The BRA_Scheduler service registers its ImagePath registry value without enclosing the full path in quotation marks, despite the path containing multiple spaces in directory names like "Program Files (x86)" and "BRAdmin Professional 3".

Attack Vector

This is a local attack vector that requires the attacker to have write permissions to one of the intermediate directory paths checked by Windows during service startup. The most accessible exploitation path is placing a malicious executable named BRAdmin.exe in the C:\Program Files (x86)\Brother\ directory. When the BRA_Scheduler service starts (either through a system reboot or manual service restart), Windows will execute the attacker's malicious binary with SYSTEM privileges before discovering the legitimate service executable.

The attack requires local access to the target system and appropriate file system permissions. Once exploited, the attacker gains code execution in the context of the SYSTEM account, achieving full privilege escalation on the affected Windows system.

Detection Methods for CVE-2021-47869

Indicators of Compromise

• Presence of unexpected executable files named BRAdmin.exe, Program.exe, or similar in paths like C:\, C:\Program Files (x86)\, or C:\Program Files (x86)\Brother\
• Unusual process execution originating from the BRA_Scheduler service context
• Unexpected child processes spawned with SYSTEM privileges from Brother-related directories
• File system modification events in the Brother installation directory hierarchy

Detection Strategies

• Query the Windows Service Control Manager for services with unquoted paths containing spaces using tools like wmic service get name,pathname | findstr /i /v """"
• Monitor for file creation events in C:\Program Files (x86)\Brother\ for executables not signed by Brother Industries
• Implement endpoint detection rules that alert on suspicious service path configurations
• Use SentinelOne's Static AI engine to detect malicious binaries placed in exploitable paths

Monitoring Recommendations

• Enable file integrity monitoring on the Brother installation directory and parent paths
• Configure alerts for new executable files created in C:\Program Files (x86)\Brother\ outside of normal software update windows
• Monitor Windows Event Log for service start events (Event ID 7036) related to BRA_Scheduler with anomalous behavior
• Deploy SentinelOne's Behavioral AI to detect privilege escalation attempts via service manipulation

How to Mitigate CVE-2021-47869

Immediate Actions Required

• Verify the BRA_Scheduler service path configuration and manually quote the ImagePath registry value if unquoted
• Restrict write permissions on the C:\Program Files (x86)\Brother\ directory to administrators only
• Audit existing files in exploitable path locations for any suspicious executables
• Consider temporarily disabling the BRA_Scheduler service if not required for operations until remediation is complete

Patch Information

Brother has not published an official patch timeline for this vulnerability. Organizations should consult the Brother Global Homepage for the latest software updates. Additional technical details and advisory information are available through the VulnCheck Advisory for BrAdmin and the Unsafe Inline 0day Report. An exploit reference is also documented at Exploit-DB #49671.

Workarounds

• Manually fix the unquoted service path by modifying the ImagePath registry value at HKLM\SYSTEM\CurrentControlSet\Services\BRA_Scheduler to enclose the full path in quotation marks
• Implement application whitelisting to prevent unauthorized executables from running in the Brother installation directory
• Remove write permissions for non-administrator users from all directories in the service path hierarchy
• Deploy SentinelOne endpoint protection to detect and block malicious binaries attempting privilege escalation

# Configuration example - Fix unquoted service path via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Services\BRA_Scheduler" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files (x86)\Brother\BRAdmin Professional 3\braschedu.exe\"" /f