CVE-2021-47869: Brother BRAdmin Privilege Escalation Flaw

CVE-2021-47869 Overview

Brother BRAdmin Professional 3.75 contains an unquoted service path vulnerability in the BRA_Scheduler service that allows local users to potentially execute arbitrary code. Attackers can place a malicious executable named 'BRAdmin' in the C:\Program Files (x86)\Brother\ directory to gain local system privileges. This vulnerability is classified under CWE-428 (Unquoted Search Path or Element).

Critical Impact
Local attackers with write access to the Brother installation directory can achieve privilege escalation to SYSTEM-level access by exploiting the unquoted service path in the BRA_Scheduler service.

Affected Products

Brother BRAdmin Professional 3.75
BRA_Scheduler Windows Service
Brother printer management software installations with default configurations

Discovery Timeline

2026-01-21 - CVE CVE-2021-47869 published to NVD
2026-01-21 - Last updated in NVD database

Technical Details for CVE-2021-47869

Vulnerability Analysis

The vulnerability exists because the BRA_Scheduler service in Brother BRAdmin Professional 3.75 is configured with an unquoted service path. When Windows services are installed with paths containing spaces that are not enclosed in quotation marks, the operating system's path parsing behavior can be exploited. The service path C:\Program Files (x86)\Brother\BRAdmin Professional 3\braschedu.exe contains spaces but lacks proper quoting, creating an exploitable condition.

When the service starts, Windows attempts to locate the executable by parsing the path from left to right, testing each space-delimited segment. This means Windows will first attempt to execute C:\Program.exe, then C:\Program Files.exe, then C:\Program Files (x86)\Brother\BRAdmin.exe before finally reaching the intended executable path. An attacker who can write to any of these intermediate paths can hijack the service execution.

Root Cause

The root cause is improper service installation that fails to quote the executable path in the Windows Service Control Manager configuration. The BRA_Scheduler service registers its ImagePath registry value without enclosing the full path in quotation marks, despite the path containing multiple spaces in directory names like "Program Files (x86)" and "BRAdmin Professional 3".

Attack Vector

This is a local attack vector that requires the attacker to have write permissions to one of the intermediate directory paths checked by Windows during service startup. The most accessible exploitation path is placing a malicious executable named BRAdmin.exe in the C:\Program Files (x86)\Brother\ directory. When the BRA_Scheduler service starts (either through a system reboot or manual service restart), Windows will execute the attacker's malicious binary with SYSTEM privileges before discovering the legitimate service executable.

The attack requires local access to the target system and appropriate file system permissions. Once exploited, the attacker gains code execution in the context of the SYSTEM account, achieving full privilege escalation on the affected Windows system.

Detection Methods for CVE-2021-47869

Indicators of Compromise

Presence of unexpected executable files named BRAdmin.exe, Program.exe, or similar in paths like C:\, C:\Program Files (x86)\, or C:\Program Files (x86)\Brother\
Unusual process execution originating from the BRA_Scheduler service context
Unexpected child processes spawned with SYSTEM privileges from Brother-related directories
File system modification events in the Brother installation directory hierarchy

Detection Strategies

Query the Windows Service Control Manager for services with unquoted paths containing spaces using tools like wmic service get name,pathname | findstr /i /v """"
Monitor for file creation events in C:\Program Files (x86)\Brother\ for executables not signed by Brother Industries
Implement endpoint detection rules that alert on suspicious service path configurations
Use SentinelOne's Static AI engine to detect malicious binaries placed in exploitable paths

Monitoring Recommendations

Enable file integrity monitoring on the Brother installation directory and parent paths
Configure alerts for new executable files created in C:\Program Files (x86)\Brother\ outside of normal software update windows
Monitor Windows Event Log for service start events (Event ID 7036) related to BRA_Scheduler with anomalous behavior
Deploy SentinelOne's Behavioral AI to detect privilege escalation attempts via service manipulation

How to Mitigate CVE-2021-47869

Immediate Actions Required

Verify the BRA_Scheduler service path configuration and manually quote the ImagePath registry value if unquoted
Restrict write permissions on the C:\Program Files (x86)\Brother\ directory to administrators only
Audit existing files in exploitable path locations for any suspicious executables
Consider temporarily disabling the BRA_Scheduler service if not required for operations until remediation is complete

Patch Information

Brother has not published an official patch timeline for this vulnerability. Organizations should consult the Brother Global Homepage for the latest software updates. Additional technical details and advisory information are available through the VulnCheck Advisory for BrAdmin and the Unsafe Inline 0day Report. An exploit reference is also documented at Exploit-DB #49671.

Workarounds

Manually fix the unquoted service path by modifying the ImagePath registry value at HKLM\SYSTEM\CurrentControlSet\Services\BRA_Scheduler to enclose the full path in quotation marks
Implement application whitelisting to prevent unauthorized executables from running in the Brother installation directory
Remove write permissions for non-administrator users from all directories in the service path hierarchy
Deploy SentinelOne endpoint protection to detect and block malicious binaries attempting privilege escalation

bash

# Configuration example - Fix unquoted service path via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Services\BRA_Scheduler" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files (x86)\Brother\BRAdmin Professional 3\braschedu.exe\"" /f