CVE-2021-23879: Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and ...

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-15 · updated 2026-06-17
Weakness: CWE-428

Description

Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and protect the execution path. Local admin privileges are required to place the files in the required location.

Affected products

McAfee, LLC Endpoint Product Removal Tool: before 21.2 — fixed in 21.2

How to fix

Upgrade to a fixed version: McAfee, LLC Endpoint Product Removal Tool 21.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-23879 or the next vulnerability affects your stack