CVE-2021-47891
Published: 23 January 2026
Description
Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands. Attackers can exploit the service by connecting to port 9512 and sending specially crafted packets to open a command…
more
prompt and download and execute malicious payloads.
Mitigating Controls (NIST 800-53 r5)AI
AC-14 directly prohibits permitting critical functions like remote command execution without identification or authentication, addressing the core CWE-306 issue in this service.
CM-7 enforces least functionality by disabling or restricting unnecessary services like Unified Remote on port 9512 that expose RCE risks.
SC-7 provides boundary protection to monitor and control network traffic to port 9512, blocking unauthorized remote access attempts.
Security SummaryAI
CVE-2021-47891 is a remote code execution vulnerability in Unified Remote version 3.9.0.2463. The issue, linked to CWE-306 (Missing Authentication for Critical Function), allows attackers to send crafted network packets to the service, which listens on TCP port 9512, resulting in the execution of arbitrary commands. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its severe potential impact.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. By connecting to port 9512 and transmitting specially crafted packets, they can open a command prompt on the target system and download and execute malicious payloads, achieving full compromise with high confidentiality, integrity, and availability effects.
Reference materials include a proof-of-concept exploit published on Exploit-DB at https://www.exploit-db.com/exploits/49587 and an advisory from VulnCheck at https://www.vulncheck.com/advisories/unified-remote-remote-code-execution. The vendor's site at https://www.unifiedremote.com/ and download page at https://www.unifiedremote.com/download provide additional context, though specific mitigation or patch details are not outlined in the available information.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote code execution via crafted network packets to a public-facing service on port 9512 directly enables T1190: Exploit Public-Facing Application.