PT-2026-3159 · Totalav · Totalav

Andrea Intilangelo · Publicado 2026-01-15 · Atualizado 2026-02-09 · CVE-2021-47787

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions TotalAV version 5.15.69

Description TotalAV version 5.15.69 contains an unquoted service path issue in multiple system services running with LocalSystem privileges. An attacker can place malicious executables in specific unquoted path segments, potentially gaining SYSTEM-level access by exploiting the service path configuration.

Recommendations Ensure service paths are properly quoted to prevent the placement of malicious executables.

Exploit

Correção

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

CVE-2021-47787

Produtos afetados

Totalav

Referências · 8

• 🔥 https://exploit-db.com/exploits/50314 · Exploit
• https://totalav.com · Nota
• https://twitter.com/cracbot/status/2013929624741531660 · Publicação no Twitter
• https://vulncheck.com/advisories/totalav-unquoted-service-path · Nota
• https://osv.dev/vulnerability/CVE-2021-47787 · Aviso do Fabricante
• https://t.me/cveNotify/151402 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-47787 · Nota de Segurança
• https://twitter.com/CVEnew/status/2012126502993752495 · Publicação no Twitter