CVE-2021-47804: 
Wise Care 365 vulnerability analysis and mitigation

CVE-2021-47804 is an unquoted service path vulnerability (CWE-428) in Wise Care 365 version 5.6.7.568, specifically affecting the WiseBootAssistant service, which runs with LocalSystem privileges. An authenticated local attacker can exploit this flaw by placing a malicious executable in the unquoted service path, which Windows will execute with SYSTEM-level privileges upon service restart. The CVE was published to NVD on January 15, 2026, despite the CVE identifier suggesting an earlier discovery period. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High), as scored by VulnCheck (VulnCheck Advisory).

The root cause is CWE-428 (Unquoted Search Path or Element): when Windows resolves a service binary path that contains spaces and is not enclosed in quotation marks, it attempts to execute each space-delimited path segment as a potential executable. In the case of WiseBootAssistant, the service path is unquoted and contains spaces, allowing a low-privileged local user to place a crafted executable at an earlier path resolution point (e.g., C:\Program.exe or C:\Program Files\Wise.exe). When the service is restarted — either manually, on system reboot, or via a trigger — Windows executes the attacker-controlled binary with LocalSystem privileges. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB PoC, VulnCheck Advisory).

Successful exploitation grants the attacker full SYSTEM-level code execution on the affected Windows host, resulting in high confidentiality, integrity, and availability impact. An attacker can read or exfiltrate sensitive data, install persistent backdoors, disable security controls, or use the compromised system as a pivot point for lateral movement within the network. Because the WiseBootAssistant service runs as LocalSystem, there is no privilege boundary remaining on the local machine after exploitation (VulnCheck Advisory).

A public proof-of-concept exploit for this vulnerability is available on Exploit-DB (EDB-ID 50038), lowering the bar for exploitation (Exploit-DB PoC). Exploitation requires only low-privilege local access and no user interaction, making it straightforward for any authenticated user on the system. The EPSS score is approximately 0.012% (0.000120), indicating a currently low probability of widespread automated exploitation. There is no evidence of active in-the-wild exploitation or CISA KEV catalog inclusion at this time (VulnCheck Advisory).

1. Reconnaissance: Enumerate installed services on the target Windows system using sc qc WiseBootAssistant or wmic service get name,pathname,startmode | findstr /i "wise" to confirm the unquoted service path and identify the exploitable path segments.
2. Identify writable path segment: Determine which parent directory in the unquoted service path the low-privileged attacker can write to (e.g., C:\Program Files\Wise Care 365\) using icacls to check directory permissions.
3. Craft malicious executable: Compile or obtain a malicious payload (e.g., a reverse shell or privilege escalation binary) and name it to match the first space-delimited path segment Windows will attempt (e.g., Wise.exe or the appropriate truncated name based on the actual service path).
4. Place the executable: Copy the malicious binary to the writable directory that precedes the legitimate service binary in Windows path resolution order.
5. Trigger service restart: Wait for a system reboot, or if the attacker has permissions, restart the WiseBootAssistant service using sc stop WiseBootAssistant && sc start WiseBootAssistant or Restart-Service WiseBootAssistant.
6. Achieve SYSTEM execution: Windows resolves the unquoted path and executes the attacker's binary with LocalSystem privileges, granting full system compromise (Exploit-DB PoC, VulnCheck Advisory).

• Logs: Windows System Event Log entries showing WiseBootAssistant service (re)starts (Event ID 7036) followed immediately by unexpected process creation events; Security Event Log entries (Event ID 4688) showing unusual processes spawned with SYSTEM privileges from a path other than the legitimate Wise Care 365 installation directory.
• File System: Presence of unexpected executables in directories along the WiseBootAssistant service path (e.g., C:\Program.exe, C:\Program Files\Wise.exe, or similar truncated-path executables); newly created or modified files in Wise Care 365 installation directories by non-administrative accounts.
• Process: Unusual processes running as SYSTEM that are not part of the standard Wise Care 365 installation (e.g., reverse shells, cmd.exe, powershell.exe) with a parent process of services.exe.
• Network: Unexpected outbound network connections originating from a SYSTEM-level process shortly after a service restart event (VulnCheck Advisory).

Users should check the WiseCleaner website for an updated version of Wise Care 365 that corrects the unquoted service path in WiseBootAssistant (Wise Care 365). As an immediate workaround, administrators can manually edit the service registry key (HKLM\SYSTEM\CurrentControlSet\Services\WiseBootAssistant, ImagePath value) to enclose the executable path in double quotation marks, then restart the service. Additionally, restricting write permissions on directories in the service path to only SYSTEM and Administrators reduces the risk of exploitation by low-privileged users (VulnCheck Advisory).

The vulnerability was reported and scored by VulnCheck, which published an advisory and submitted the CVE to NVD in January 2026. A technical write-up was published by Infinit Security (Infinit Security). No significant vendor statements from WiseCleaner or broad community discussion have been identified beyond the standard vulnerability disclosure channels.