CVE-2021-47974: VX Search Privilege Escalation Flaw

CVE-2021-47974 Overview

CVE-2021-47974 is an unquoted service path vulnerability in VX Search Server and VX Search Enterprise version 13.5.28. Both Windows services register with unquoted executable paths containing spaces, such as C:\Program Files\VX Search\bin\service.exe. Local attackers with write access to intermediate directories can plant a malicious executable that Windows will load instead of the intended binary. When the service starts or restarts, the planted binary runs with LocalSystem privileges, granting full control of the host. The weakness is tracked as CWE-428, Unquoted Search Path or Element.

Critical Impact
Successful exploitation grants NT AUTHORITY\SYSTEM code execution on the affected Windows host, enabling full compromise from a low-privileged local account.

Affected Products

VX Search Server 13.5.28
VX Search Enterprise 13.5.28
Windows installations using the default C:\Program Files\VX Search path

Discovery Timeline

2021 - Exploit published as Exploit-DB #50026
2026-05-16 - CVE-2021-47974 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2021-47974

Vulnerability Analysis

The vulnerability stems from the Windows Service Control Manager (SCM) parsing of unquoted ImagePath registry values. When a service path contains spaces and is not wrapped in quotes, the SCM attempts to execute each whitespace-delimited token as a candidate executable. VX Search 13.5.28 installs its services with paths like C:\Program Files\VX Search\bin\service.exe without enclosing quotes. Windows therefore attempts to load C:\Program.exe, C:\Program Files\VX.exe, and C:\Program Files\VX Search\bin.exe before resolving the intended binary. A local attacker who can write to any of these locations can stage a payload that the service launches at startup. Because VX Search services run as LocalSystem, the planted code inherits the highest privilege level on the host.

Root Cause

The root cause is the installer's failure to quote the service ImagePath value during registration with the SCM. The Common Weakness Enumeration entry CWE-428 describes this exact pattern. The product also installs into a directory whose default ACL permits writes by certain user contexts in misconfigured deployments, amplifying the exposure.

Attack Vector

Exploitation requires local authenticated access with the ability to write to one of the unquoted path segments or with permission to restart the service. The attacker drops a crafted executable, for example C:\Program Files\VX.exe, then waits for or triggers a service restart. On the next service start, the SCM executes the attacker's binary as LocalSystem. No user interaction is required and the attack complexity is low. Public exploit code for this technique is documented in the VulnCheck advisory and Exploit-DB #50026.

Detection Methods for CVE-2021-47974

Indicators of Compromise

Unexpected executables in root or Program Files directories such as C:\Program.exe, C:\Program Files\VX.exe, or C:\Program Files\VX Search\bin.exe
New child processes spawned by services.exe running from non-standard paths
Service start events (Windows Event ID 7036) for VX Search services followed by unusual process creation under LocalSystem
Modifications to HKLM\SYSTEM\CurrentControlSet\Services\ entries referencing VX Search

Detection Strategies

Enumerate Windows services and flag any ImagePath value that contains a space and is not enclosed in quotes using wmic service get name,pathname,startmode
Monitor process creation telemetry (Sysmon Event ID 1) for processes launched from path segments preceding the legitimate service binary
Alert on file writes to C:\ root or C:\Program Files\ that produce .exe files matching the truncated tokens of known service paths

Monitoring Recommendations

Forward Windows Security, System, and Sysmon logs to a central SIEM and correlate service restarts with new binary creation events
Establish a baseline of legitimate LocalSystem child processes and alert on deviations
Audit NTFS permissions on C:\ and C:\Program Files\ to confirm only privileged users hold write access

How to Mitigate CVE-2021-47974

Immediate Actions Required

Inventory all hosts running VX Search Server or VX Search Enterprise 13.5.28 and identify services with unquoted paths
Manually quote the ImagePath value for affected services in the registry, then restart the service to validate the fix
Restrict write permissions on C:\ and C:\Program Files\ to administrators only on systems running VX Search

Patch Information

No vendor patch URL is referenced in the NVD entry at publication. Administrators should consult the VXSearch resource site for updated builds and the VulnCheck advisory for remediation guidance. Upgrade to a version where service paths are properly quoted at installation.

Workarounds

Edit HKLM\SYSTEM\CurrentControlSet\Services\<VXSearchService>\ImagePath and wrap the path in double quotes
Remove any non-administrator write permissions from directories in the service path hierarchy
Apply application allowlisting to prevent unauthorized executables from running under LocalSystem

bash

# Verify quoted service paths on Windows
wmic service get name,pathname,startmode | findstr /i "VX Search"

# Example registry fix (run as Administrator)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VXSearchService" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\VX Search\bin\service.exe\"" /f