CVE-2021-47767

High

Published: 15/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

CVE-2021-47767 affects 10-Strike Network Inventory Explorer Pro version 9.31. The vulnerability is due to an unquoted service path in the srvInventoryWebServer service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path segments to achieve privilege escalation and execute code with system-level permissions.

Risk Assessment

The risk to the organization is critical because an attacker can gain full control of the system, potentially leading to infrastructure compromise, data theft, or malware installation. The vulnerability can be exploited locally by a user with limited privileges.

Recommendation

It is recommended to immediately update 10-Strike Network Inventory Explorer Pro to the latest version that fixes this vulnerability. Additionally, check and fix the service path to be quoted, and restrict the service account privileges if possible.

Other vulnerabilities in 10-Strike Network Inventory Explorer Pro

CVE-2021-47772Critical
10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution. Attackers can craft a malicious text file with carefully constructed payload to trigger a reverse shell and execute arbitrary code on the target system.

Original NVD description (English source)

10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path segments to achieve privilege escalation and execute code with system-level permissions.