CVE-2021-47985 Overview
CVE-2021-47985 is an unquoted service path vulnerability in Brother SAPSprint 7.60. The SAPSprint service binary is registered with an unquoted file path in Program Files. Local attackers with write access to intermediate directories can place a malicious executable that Windows loads when the service starts. The service runs as LocalSystem, so successful exploitation results in full privilege escalation. The weakness is classified under CWE-428: Unquoted Search Path or Element.
Critical Impact
A local attacker with limited privileges can gain LocalSystem code execution by dropping a binary into an unquoted service path, fully compromising the affected Windows host.
Affected Products
- Brother SAPSprint 7.60
- Windows hosts running the SAPSprint service
- Environments using Brother SAP printing integration
Discovery Timeline
- 2026-06-19 - CVE-2021-47985 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2021-47985
Vulnerability Analysis
The SAPSprint service is installed with an unquoted ImagePath registry value that contains spaces. Windows Service Control Manager parses unquoted paths by attempting each whitespace-delimited prefix as an executable. When the path resembles C:\Program Files\Brother\SAPSprint\sapsprint.exe, Windows will sequentially try C:\Program.exe, C:\Program Files\Brother\SAPSprint.exe, and so on. An attacker who can write to any of these intermediate locations can supply a substitute binary. The substitute executes in the service's security context at start time.
Root Cause
The root cause is improper quoting of the service binary path during installation. The vulnerability falls under [CWE-428], where a file path containing spaces is not enclosed in quotation marks. This causes the operating system loader to interpret path fragments as candidate executables before resolving the full intended target.
Attack Vector
Exploitation requires local access and write permission to a directory in the service path, such as C:\ or C:\Program Files\Brother\. Default Windows ACLs restrict writes to C:\ and Program Files, so successful exploitation typically depends on misconfigured permissions or pre-existing low-privilege footholds. Once a malicious binary is placed, the attacker triggers privilege escalation by restarting the service or waiting for system reboot. Technical details are available in the VulnCheck Security Advisory and Exploit-DB entry 50061.
Detection Methods for CVE-2021-47985
Indicators of Compromise
- Unexpected executables such as Program.exe or Brother.exe placed in C:\ or C:\Program Files\
- New child processes spawned by services.exe running from non-standard paths
- Modifications to ACLs on directories within the SAPSprint service path
- Service restart events for SAPSprint correlated with file creation events
Detection Strategies
- Audit Windows service registrations for unquoted ImagePath values containing spaces using wmic service get name,pathname,startmode
- Monitor process creation events (Event ID 4688, Sysmon Event ID 1) where the parent is services.exe and the image path is unexpected
- Inspect file creation in C:\ and C:\Program Files\ root directories for .exe files matching service path fragments
Monitoring Recommendations
- Enable command-line logging and Sysmon to capture service binary execution context and parent-child relationships
- Forward service start events (Event ID 7036) and file integrity monitoring alerts to a centralized log platform
- Correlate low-privilege user file writes in protected directories with subsequent SYSTEM-level process executions
How to Mitigate CVE-2021-47985
Immediate Actions Required
- Quote the SAPSprint service ImagePath registry value to enclose the full executable path in double quotes
- Verify and harden filesystem ACLs on C:\ and C:\Program Files\ to prevent non-administrator write access
- Inventory all installed services on affected hosts and remediate any other unquoted paths discovered
Patch Information
No vendor patch is referenced in the available CVE data. Administrators should consult the Brother official website for product updates and apply available security releases. The VulnCheck Security Advisory provides additional remediation context.
Workarounds
- Manually edit the registry key under HKLM\SYSTEM\CurrentControlSet\Services\SAPSprint to wrap the ImagePath value in quotation marks, then restart the service
- Restrict the service account or disable automatic startup until the path is corrected
- Apply least-privilege controls so that standard users cannot create files in directories traversed by the service path
# Inspect and remediate unquoted service paths on Windows
# List services with unquoted paths containing spaces
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "\""
# Correct the SAPSprint ImagePath (run as Administrator)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SAPSprint" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Brother\SAPSprint\sapsprint.exe\"" /f
# Restart the service to apply the change
sc stop SAPSprint
sc start SAPSprint
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
