CVE-2021-47803

8.5 highEPSS 0.2%

High (8.5). EPSS 0.2% chance of exploitation in the next 30 days.

iFunbox 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service that allows local attackers to execute code with elevated privileges. Attackers can insert a malicious executable into the unquoted service path to run with LocalSystem privileges when the service restarts.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-31)
CWE: CWE-428
Published: 2026-01-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.exploit-db.com/exploits/50040
https://www.i-funbox.com/en/index.html
https://www.vulncheck.com/advisories/ifunbox-apple-mobile-device-service-unquoted-service-path

Check your stack JSON