Description Summary:
A security vulnerability exists in the Acer Planet9 background service due to incorrect file permissions on an application executable, allowing local privilege escalation to SYSTEM.

Executive Summary:
An incorrect permission assignment vulnerability in the Acer Planet9 background service allows local attackers to escalate privileges to SYSTEM.

Vulnerability Details

CVE-ID: CVE-2026-50602

Affected Software: Acer Planet9 background service

Affected Versions: All versions prior to the automatic update that removes affected executable files and uninstalls the service.

Vulnerability: This vulnerability, classified as CWE-732, involves incorrect file permissions assigned to an executable used by the Planet9 background service. Because the service operates with SYSTEM privileges, a local, authenticated user can leverage these weak permissions to gain full administrative control over the host.

Business Impact

The ability for a local user to gain SYSTEM privileges represents a severe security compromise. An attacker could install malicious software, modify system configurations, or access sensitive data, leading to a total loss of confidentiality, integrity, and availability on the affected host. Given the CVSS score of 8.5, this is a high-risk flaw that should be addressed immediately to prevent lateral movement or total system takeover.

Remediation Plan

Immediate Action: Ensure that the Planet9 background service has been automatically updated, which removes the vulnerable executable files and uninstalls the PLANET9DAService.

Proactive Monitoring: Review system access logs for unauthorized attempts to modify service executables or unusual process execution patterns under the SYSTEM account.

Compensating Controls: Restrict local user access to the file system where application executables are stored, and enforce the principle of least privilege for all non-administrative accounts on the endpoint.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the high-privilege context in which the service executes.

Analyst Recommendation

The risk of local privilege escalation to SYSTEM status is severe and requires prompt attention. IT administrators should verify that the automatic update has successfully removed the vulnerable components. If the automated process fails, manual intervention is required to uninstall the affected service to neutralize the threat.

Description Summary:
Exposed diagnostic software on retail builds of Acer Connect M6E 5G allows malicious applications to write to internal NVRAM registers.

Executive Summary:
A critical security flaw in Acer Connect M6E 5G firmware leaves factory diagnostic interfaces exposed, enabling unauthorized write access to sensitive internal hardware registers.

Vulnerability Details

CVE-ID: CVE-2026-50211

Affected Software: Acer Connect M6E 5G

Affected Versions: Unknown; affects retail firmware builds.

Vulnerability: This vulnerability involves the improper exposure of engineering and factory-level diagnostic software in production environments. An attacker can leverage this exposure to perform out-of-bounds writes to internal NVRAM registers, potentially leading to persistent device compromise.

Business Impact

Rated at a CVSS score of 9.8, this vulnerability poses a severe threat to device integrity. An attacker could potentially bypass security controls, modify device configuration, or achieve persistent control over the hardware, leading to complete loss of device trust and potential network-wide lateral movement.

Remediation Plan

Immediate Action: Remove any remaining diagnostic software and apply firmware updates from the vendor to secure internal NVRAM registers.

Proactive Monitoring: Monitor device logs for anomalous configuration changes or unauthorized attempts to access diagnostic or management interfaces.

Compensating Controls: Isolate affected devices from public-facing networks and restrict administrative access to management interfaces to trusted internal segments only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant hardware-level security risk. Administrators must prioritize the removal of diagnostic tools and ensure that all firmware is patched to the latest version provided by Acer. Verify that no unauthorized diagnostic services are reachable from the network.

Description Summary:
An unauthenticated debug service vulnerability allows potential remote code execution or unauthorized system access.

Executive Summary:
A critical vulnerability in an exposed debug service allows unauthenticated attackers to potentially gain full control of the affected product.

Vulnerability Details

CVE-ID: CVE-2026-49195

Affected Software: Unknown, Debug Service

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in an unauthenticated debug service that is active by default or through misconfiguration. This allows an unauthenticated attacker to interact with the service and potentially execute commands with elevated privileges.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to the confidentiality, integrity, and availability of any system running the affected debug service. Successful exploitation could lead to full system compromise, data theft, and persistent unauthorized access.

Remediation Plan

Immediate Action: Disable the debug service immediately if it is not required for production operations. If required, ensure it is restricted to authorized internal management interfaces.

Proactive Monitoring: Monitor for unexpected network connections on ports associated with debug services and review system logs for unauthorized command execution.

Compensating Controls: Utilize host-based firewalls to block external access to debug ports and ensure the service is not exposed to the internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, the presence of an unauthenticated debug interface is a severe security misconfiguration that must be addressed immediately.

Analyst Recommendation

Security teams should scan their environment for any instances of exposed debug services. We recommend taking the service offline immediately and applying vendor-provided security patches to remove the underlying vulnerability.

Description Summary:
The SCREEN_CLICK(5053) debugging routine allows an unauthenticated connection to bypass the login prompt and access an interactive shell.

Executive Summary:
An authentication bypass vulnerability in a debugging routine allows attackers to gain direct shell access to the affected device without valid credentials.

Vulnerability Details

CVE-ID: CVE-2026-49194

Affected Software: Unknown

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in a specific debugging function, SCREEN_CLICK(5053), which fails to enforce authentication. This allows an attacker to bypass the login process entirely and gain an interactive shell interface.

Business Impact

The CVSS score of 8.8 indicates a high-risk scenario where an attacker can gain administrative access to the system. This level of access poses a severe threat, including full system control, data theft, and the ability to pivot into other parts of the network.

Remediation Plan

Immediate Action: Disable the affected debugging routine if possible or apply the vendor-provided security patch.

Proactive Monitoring: Monitor for unusual shell access, unexpected login events, and unauthorized connections to device interfaces.

Compensating Controls: Restrict network access to the affected device to trusted management networks and utilize network-level authentication (e.g., VPN) to mitigate unauthorized access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to bypass authentication for a shell interface is an extreme security failure. Organizations must treat this as a high-priority incident and apply vendor updates or disable the vulnerable debug feature immediately to prevent unauthorized access.

Description Summary:
The M3WebServer in the Acer Connect M6E 5G router hard-codes backend API keys, which are exposed via verbose error pages.

Executive Summary:
A critical security vulnerability in the Acer Connect M6E 5G router allows for the unauthorized retrieval of hard-coded API keys, potentially compromising backend services.

Vulnerability Details

CVE-ID: CVE-2026-49191

Affected Software: Acer Connect M6E 5G Portable WiFi Router

Affected Versions: Acer Connect M6E 5G Portable WiFi Router affected through M6E_AI_1.00.000019

Vulnerability: This vulnerability involves the use of hard-coded credentials within the M3WebServer component. These sensitive keys can be intercepted by unauthenticated attackers through verbose error handling pages generated by the web server.

Business Impact

The exposure of backend API keys grants attackers the ability to impersonate the device or access protected cloud services associated with the router. Given the CVSS score of 9.8, this vulnerability poses a severe risk to the confidentiality and integrity of the device's management ecosystem and associated infrastructure.

Remediation Plan

Immediate Action: Update the device firmware to the latest available version as specified in the Acer security advisory.

Proactive Monitoring: Monitor device access logs for unusual requests or repeated errors directed toward the web management interface.

Compensating Controls: Restrict access to the router's web management interface to trusted administrative IPs only, preventing external exposure of error pages.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security failure due to the exposure of sensitive credentials. Organizations using the Acer Connect M6E 5G must prioritize firmware updates to remediate the hard-coded key issue and secure the web server environment.

Description Summary:
The system fails to enforce proper instructional permissions over internal opcodes, enabling unauthorized application installation or command execution.

Executive Summary:
A critical permission evaluation failure allows unauthorized actors to execute arbitrary commands or install malicious software on the affected system.

Vulnerability Details

CVE-ID: CVE-2026-49190

Affected Software: Unknown

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from an insufficient check on internal operation codes (opcodes). By bypassing these permission checks, an attacker can trigger unauthorized administrative functions, such as installing packages or executing system-level commands.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to system integrity and confidentiality. Unauthorized command execution could lead to a complete system compromise, data exfiltration, or the deployment of persistent backdoors.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches immediately upon availability.

Proactive Monitoring: Audit system logs for unauthorized installation events, unexpected process execution, and changes to system configuration files.

Compensating Controls: Enforce strict application whitelisting and restrict administrative access to the system to prevent unauthorized command execution until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the potential for full system control. It is recommended that organizations identify the affected software in their environment and apply remediation measures as soon as the vendor releases a security update.

Description Summary:
The ai_cmd utility on the Acer Connect M6E 5G router runs with root privileges and is vulnerable to unauthenticated command injection via popen().

Executive Summary:
A critical vulnerability in the ai_cmd utility of the Acer Connect M6E 5G router allows unauthenticated attackers to execute arbitrary code with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-49188

Affected Software: Acer Connect M6E 5G Portable WiFi Router

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The ai_cmd utility executes with full root permissions and pipes socket inputs directly into the popen() function without sanitization. This enables unauthenticated attackers to trigger arbitrary command execution with the highest level of system privilege.

Business Impact

Full root compromise allows an attacker to take complete control of the router, potentially leading to persistent malware installation, data interception, and lateral movement within the network. The CVSS score of 9.8 reflects the extreme risk this vulnerability poses to the host system.

Remediation Plan

Immediate Action: Apply the latest firmware update from Acer to patch the ai_cmd utility and sanitize input handling.

Proactive Monitoring: Audit system logs for unauthorized root process execution or suspicious socket activity.

Compensating Controls: Use network segmentation to ensure the device is not reachable from the public internet, limiting the attack surface for unauthenticated exploit attempts.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a high-urgency vulnerability due to the root privilege escalation path. Immediate patching is required to prevent total system compromise by remote, unauthenticated attackers.

Description Summary:
The local MQTT broker on the Acer Connect M6E 5G router fails to enforce ACLs, allowing unauthorized clients to enumerate devices and publish rogue commands.

Executive Summary:
A critical access control vulnerability in the Acer Connect M6E 5G router’s MQTT broker allows unauthorized clients to manipulate network devices and intercept data.

Vulnerability Details

CVE-ID: CVE-2026-49186

Affected Software: Acer Connect M6E 5G Portable WiFi Router

Affected Versions: Acer Connect M6E 5G Portable WiFi Router up to M6E_AI_1.00.000019

Vulnerability: The local MQTT broker lacks topic-level Access Control Lists (ACLs). This allows any client to use wildcard characters to subscribe to sensitive topics, enumerate hidden network devices, or publish unauthorized control commands.

Business Impact

The lack of access control exposes the internal network architecture and allows for rogue control of connected IoT/network devices. With a CVSS score of 9.8, this flaw poses a significant risk to the integrity and availability of the local network environment.

Remediation Plan

Immediate Action: Update to the latest firmware version to ensure proper MQTT broker configuration and ACL enforcement are implemented.

Proactive Monitoring: Monitor MQTT traffic for unexpected subscription patterns or unauthorized publish requests.

Compensating Controls: Isolate the router from untrusted network segments and restrict access to the MQTT broker port (typically 1883) to authorized internal clients only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability significantly undermines the security of the local network. Organizations should prioritize updating the device firmware to enforce necessary access controls on the MQTT broker.

Description Summary:
The FieldX MDM component in the Acer Connect M6E 5G router is vulnerable to command injection via unverified payloads in the adb messaging topic.

Executive Summary:
A critical command injection vulnerability in the Acer Connect M6E 5G router's FieldX MDM module allows for arbitrary instruction execution.

Vulnerability Details

CVE-ID: CVE-2026-49185

Affected Software: Acer Connect M6E 5G Portable WiFi Router

Affected Versions: Acer Connect M6E 5G Portable WiFi Router up to M6E_AI_1.00.000019

Vulnerability: The vulnerability exists in the adb messaging topic, which fails to verify payloads before passing them to the Runtime.exec() function. This allows attackers to inject and execute arbitrary commands on the affected device.

Business Impact

The ability to execute arbitrary commands with high privileges provides an attacker with complete control over the device. Given the CVSS score of 9.8, this could lead to the compromise of the local network environment where the router is deployed.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Acer to address the command injection flaw in the MDM component.

Proactive Monitoring: Monitor for anomalous adb messaging traffic or unexpected process execution on the router.

Compensating Controls: Disable remote management and ADB-related features if they are not strictly required for current operations.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the ease of command execution. It is imperative that users update their firmware to the latest version to prevent unauthorized system control.

Description Summary:
LogonTracer is vulnerable to OS command injection, allowing an authenticated user to execute arbitrary commands on the underlying operating system.

Executive Summary:
A critical OS command injection vulnerability in JPCERT/CC LogonTracer allows authenticated users to execute arbitrary system commands, posing a severe risk to host integrity.

Vulnerability Details

CVE-ID: CVE-2026-33277

Affected Software: JPCERT/CC LogonTracer

Affected Versions: prior to v2.0.0

Vulnerability: This vulnerability is a classic OS command injection (CWE-78) flaw. It allows an authenticated user to bypass input validation and execute arbitrary commands on the host system, which could lead to a full system compromise.

Business Impact

The CVSS score of 8.8 reflects the high severity of this vulnerability, as successful exploitation results in total loss of confidentiality, integrity, and availability for the affected host. Because the application processes log data, unauthorized command execution could allow an attacker to pivot into the network, exfiltrate sensitive security logs, or disable defensive monitoring capabilities entirely.

Remediation Plan

Immediate Action: Update JPCERT/CC LogonTracer to version 2.0.0 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review system logs for suspicious process execution patterns or unexpected shell commands initiated by the service account running LogonTracer.

Compensating Controls: Restrict access to the LogonTracer interface to authorized personnel only, and employ network segmentation to limit the potential blast radius if the application is compromised.

Exploitation Status

Public Exploit Available: No (the available data does not confirm the existence of a public exploit or proof-of-concept).

Analyst Notes: As of April 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is highly dangerous, it requires a logged-in user to trigger, which serves as a primary, though insufficient, defensive barrier.

Analyst Recommendation

Given the potential for full system compromise, organizations should prioritize upgrading LogonTracer to version 2.0.0 without delay. Ensure that authentication policies for all internal tools are strictly enforced to minimize the surface area for this type of command injection attack.

Description Summary:
An OS command injection vulnerability in the traceroute diagnostic handler of Altice Labs GR140DG routers allows authenticated remote attackers to execute arbitrary commands as root.

Executive Summary:
Authenticated remote attackers can achieve full root-level code execution on Altice Labs GR140DG routers by exploiting an OS command injection flaw in the traceroute diagnostic handler.

Vulnerability Details

CVE-ID: CVE-2026-31196

Affected Software: Altice Labs GR140DG Fibre Router

Affected Versions: Firmware 3GN8020801R13, 3GN8020802R0A, 3GN8020803R0A

Vulnerability: Similar to the ping handler vulnerability, the traceroute handler in /bin/httpd_clientside fails to sanitize user input in the destAddr parameter. This allows authenticated attackers to perform shell command substitution and execute commands with root privileges.

Business Impact

The CVSS score of 8.8 highlights the critical nature of this vulnerability, as it provides a pathway for total control over the networking hardware. An attacker with access to the management interface could leverage this to gain persistence, conduct man-in-the-middle attacks, or utilize the device as a node in a botnet.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by the vendor to remediate the command injection flaw in the diagnostic tools.

Proactive Monitoring: Review router audit logs for signs of unauthorized diagnostic tool usage or unexpected outbound connections.

Compensating Controls: Strictly limit administrative access to the router's management interface to secure, dedicated management workstations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to network integrity. Immediate patching is required to ensure that the router cannot be leveraged by malicious actors to compromise the local network or internet connectivity.

Description Summary:
A local privilege escalation vulnerability in Acer ListCheck.exe allows authenticated local attackers to replace the executable with a malicious file, resulting in arbitrary code execution as the system.

Executive Summary:
The Acer ListCheck.exe utility contains a local privilege escalation vulnerability that enables authenticated attackers to execute malicious code with system level privileges.

Vulnerability Details

CVE-ID: CVE-2025-14305

Affected Software: Acer ListCheck.exe

Affected Versions: 0 through 4.0.0.1

Vulnerability: The vulnerability stems from incorrect authorization (CWE-863), where a local authenticated attacker can replace the legitimate ListCheck.exe file with a malicious version. Because the system subsequently executes this file, the attacker gains elevated privileges.

Business Impact

This vulnerability poses a significant risk to system integrity and security. By successfully exploiting this flaw, a local attacker can move from a standard user account to full system control, potentially compromising sensitive data, installing persistent backdoors, or disabling security software. Given the CVSS score of 7.8, this is classified as a High severity issue that requires immediate attention to prevent unauthorized administrative access.

Remediation Plan

Immediate Action: As the software is no longer maintained, the recommended remediation is to delete the ListCheck.exe program from all systems immediately.

Proactive Monitoring: Security teams should monitor for unauthorized file modifications in directories where legacy tools are stored and review system logs for unexpected execution of binaries.

Compensating Controls: Implement strict file system permissions and host based intrusion detection systems to prevent non-privileged users from modifying or replacing critical executable files.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of December 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any user with local access who can modify the specific directory where the application resides.

Analyst Recommendation

Because Acer has confirmed that ListCheck.exe is no longer maintained, no security patch will be released for this product. Organizations should prioritize the identification and removal of this utility from all company assets to eliminate the risk of privilege escalation. Failure to remove the software leaves the system permanently susceptible to this local attack vector.

Description Summary:
Acer Backup Manager 3.0.0.99 is vulnerable to an unquoted service path flaw in the NTI IScheduleSvc service, which could allow local attackers to execute arbitrary code with elevated system privileges.

Executive Summary:
A local privilege escalation vulnerability in Acer Backup Manager 3.0.0.99 allows attackers to achieve arbitrary code execution with LocalSystem privileges.

Vulnerability Details

CVE-ID: CVE-2021-47826

Affected Software: Acer Backup Manager

Affected Versions: 3.0.0.99

Vulnerability: The software contains an unquoted service path vulnerability (CWE-428) in the NTI IScheduleSvc service. A local, authenticated attacker can exploit this by placing a malicious executable in the service path, which the system will then execute with elevated LocalSystem privileges upon service startup.

Business Impact

The ability for a local user to escalate privileges to the LocalSystem level represents a critical security failure. An attacker who has achieved initial low-privileged access to a workstation can leverage this vulnerability to gain full control over the operating system, potentially leading to the theft of sensitive data, installation of persistent backdoors, or the deployment of ransomware. While the CVSS score is 7.8, the potential for total system compromise makes this a high-priority risk for any environment where this software is deployed.

Remediation Plan

Immediate Action: Administrators should uninstall or update the affected version of Acer Backup Manager. If an update is not available, the service should be disabled or the service path should be manually quoted in the Windows Registry to prevent the hijacking attempt.

Proactive Monitoring: Review Windows system event logs for service startup failures or unexpected executable launches originating from the NTI directory. Monitor for the creation of new, unauthorized files within the C:\Program Files (x86)\NTI\ directory.

Compensating Controls: Implement strict file system permissions on the application installation directory to prevent non-administrative users from writing or modifying files. Ensure that Endpoint Detection and Response (EDR) solutions are configured to alert on unauthorized attempts to create files in protected system folders.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit Database (EDB-ID: 49889).

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the service path lacks the required quotation marks to prevent the Windows service controller from interpreting malicious subdirectories as the intended path.

Analyst Recommendation

Given the ease of exploitation and the potential for full system compromise, organizations should prioritize the identification and remediation of all instances of Acer Backup Manager 3.0.0.99. If the software is no longer required, removal is the most effective security measure. Otherwise, ensure that standard users are restricted from modifying the installation directory and apply configuration changes to the service path as a temporary mitigation until a vendor-supplied patch is applied.

Description Summary:
The Acer Updater Service version 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code with elevated system privileges.

Executive Summary:
A local privilege escalation vulnerability in the Acer Updater Service allows attackers to execute arbitrary code with LocalSystem permissions.

Vulnerability Details

CVE-ID: CVE-2021-47825

Affected Software: Acer Updater Service

Affected Versions: 1.2.3500.0

Vulnerability: The application utilizes an unquoted service path for the UpdaterService.exe binary. A local user can exploit this weakness by placing a malicious executable in the directory structure, which the service will inadvertently execute with elevated LocalSystem privileges upon startup.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected system. Because the malicious code runs with LocalSystem privileges, the attacker can bypass standard security restrictions, install persistent backdoors, or exfiltrate sensitive data. With a CVSS score of 7.8, this represents a significant risk to the confidentiality, integrity, and availability of any workstation or server running the vulnerable service.

Remediation Plan

Immediate Action: Update the Acer Updater Service to a patched version if available, or uninstall the service if it is not required for system operations. If an update is not immediately feasible, ensure that non-administrative users do not have write permissions to the C:\Program Files\Acer\ directory.

Proactive Monitoring: Review system logs for unexpected service restarts or the creation of new executable files within the Acer installation directory. Monitor for unauthorized processes running under the LocalSystem account.

Compensating Controls: Implement strict file system permissions (Access Control Lists) to prevent unprivileged users from writing files to the path C:\Program Files\Acer. This prevents the injection of malicious binaries required to trigger the exploit.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented on Exploit-DB (EDB-ID 49890).

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any local user who can write to the filesystem, making it a common vector for post-compromise privilege escalation.

Analyst Recommendation

Given the ease with which local users can escalate their privileges to LocalSystem, this vulnerability should be treated with high priority. Organizations should audit their device fleets to identify systems running the vulnerable version of the Acer Updater Service and prioritize the application of vendor-supplied patches or the removal of the service to eliminate the attack surface.

Description Summary:
Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability allowing local users to execute arbitrary code with elevated system privileges.

Executive Summary:
A local privilege escalation vulnerability in Acer ePowerSvc 6.0.3008.0 allows low-privileged users to execute code with LocalSystem permissions.

Vulnerability Details

CVE-ID: CVE-2021-47823

Affected Software: Acer ePowerSvc

Affected Versions: 6.0.3008.0

Vulnerability: The application is susceptible to an unquoted service path vulnerability (CWE-428) in the service configuration. Because the path to the executable contains spaces and is not enclosed in quotes, a local attacker can place a malicious binary in a parent directory to be executed by the service with elevated privileges.

Business Impact

Successful exploitation of this vulnerability allows a local attacker to gain full control over the affected system by executing code with LocalSystem privileges. This bypasses standard user restrictions, potentially leading to total system compromise, data theft, and the installation of persistent malicious software. Given the CVSS score of 7.8, this poses a significant risk to host integrity and organizational security.

Remediation Plan

Immediate Action: Update the affected Acer software to the latest version provided by the vendor, or if a patch is unavailable, manually correct the service path configuration by adding quotes around the binary path in the Windows Registry.

Proactive Monitoring: Audit Windows services for unquoted service paths using tools like WMIC or PowerShell to identify other potentially vulnerable installations across the environment.

Compensating Controls: Restrict write permissions on the affected directory paths to ensure that only authorized administrators can modify files within the service installation folder.

Exploitation Status

Public Exploit Available: Yes, a technical write-up and proof-of-concept are available via the Exploit Database (EDB-ID: 49900).

Analyst Notes: As of January 18, 2026, there is no public information indicating active exploitation in the wild. While the vulnerability is not currently being exploited in the wild, the presence of a published proof-of-concept makes the risk of exploitation credible for local attackers.

Analyst Recommendation

This vulnerability represents a high-risk local privilege escalation vector that should be addressed immediately. Administrators should prioritize identifying all instances of the vulnerable service and applying the necessary configuration changes or vendor-supplied updates to prevent unauthorized elevation of privileges.

Description Summary:
Acer Global Registration Service 1.0.0.3 is vulnerable to an unquoted service path flaw, allowing local attackers to execute arbitrary code with elevated system privileges.

Executive Summary:
A critical unquoted service path vulnerability in Acer Global Registration Service allows local attackers to achieve privilege escalation to LocalSystem.

Vulnerability Details

CVE-ID: CVE-2020-36976

Affected Software: Acer Global Registration Service

Affected Versions: 1.0.0.3

Vulnerability: The application utilizes an unquoted service path for the GREGsvc.exe executable, which creates a flaw where the Windows service control manager may incorrectly interpret the path. A local user with sufficient permissions can place a malicious executable in a specific directory along the path, which will subsequently be executed with elevated LocalSystem privileges upon service startup.

Business Impact

Successful exploitation of this vulnerability grants a local attacker full administrative control over the affected system. This presents a severe risk of data exfiltration, malware installation, and long-term persistence within the environment. While the CVSS score of 7.8 indicates a high severity, the ability to escalate privileges to the highest level of system access makes this a priority for remediation on all affected endpoints.

Remediation Plan

Immediate Action: Update the Acer Global Registration Service to the latest available version provided by the vendor, or remove the software if it is not required for business operations.

Proactive Monitoring: Monitor system logs for the creation of unauthorized executables in the C:\Program Files (x86)\ directory or subdirectories associated with vendor services.

Compensating Controls: Administrators can manually remediate this issue by using the sc config command to reconfigure the service path with proper quoting or by modifying the Registry key associated with the service to include quotes around the binary path.

Exploitation Status

Public Exploit Available: Yes, an ExploitDB entry exists (EDB-ID 49142).

Analyst Notes: As of January 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it relies on standard Windows service behavior regarding unquoted paths.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for full system compromise, this vulnerability poses a significant risk to internal security. Organizations should audit their device fleets to identify instances of the Acer Global Registration Service and apply the necessary configuration changes or software updates immediately to prevent local privilege escalation.

Description Summary:
Acer Launch Manager 6.1.7600.16385 contains an unquoted service path vulnerability in the DsiWMIService that allows local users to execute code with elevated privileges.

Executive Summary:
A local privilege escalation vulnerability in Acer Launch Manager allows low-privileged users to achieve system-level code execution due to an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2019-25302

Affected Software: Acer Launch Manager

Affected Versions: 6.1.7600.16385

Vulnerability: The application utilizes an unquoted service path for the DsiWMIService component, which fails to properly handle space-delimited paths. A local attacker can exploit this by placing a malicious executable in a parent directory, which the service will then execute with SYSTEM privileges upon service startup.

Business Impact

The vulnerability carries a CVSS score of 7.8, reflecting a high-severity risk due to the potential for total system compromise. Successful exploitation grants an attacker full administrative control over the affected machine, enabling them to bypass security controls, install persistent backdoors, or access sensitive data. This poses a significant threat to organizational endpoint integrity.

Remediation Plan

Immediate Action: Administrators should uninstall the affected version of Acer Launch Manager if it is not required for system operation. If the software is necessary, ensure that the service configuration is manually updated to use a quoted path or verify if a vendor-supplied patch is available for your specific model.

Proactive Monitoring: Monitor system logs for unauthorized service creation or unexpected child processes spawned by services running under the SYSTEM account.

Compensating Controls: Implement strict file system permissions on the C:\ drive and specifically on the Program Files (x86) directory to prevent unauthorized users from creating or modifying files in high-level paths.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via Exploit-DB (EDB-ID 47577).

Analyst Notes: As of February 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit for any user with local write access to the affected directory.

Analyst Recommendation

Given the availability of a public exploit and the high potential for privilege escalation, this vulnerability must be treated with urgency. Organizations should prioritize identifying and patching or removing instances of Acer Launch Manager 6.1.7600.16385 to eliminate the risk of local administrative takeover.