A local privilege escalation vulnerability in Acer Launch Manager allows low-privileged users to achieve system-level code execution due to an unquoted service path.

The application utilizes an unquoted service path for the DsiWMIService component, which fails to properly handle space-delimited paths. A local attacker can exploit this by placing a malicious executable in a parent directory, which the service will then execute with SYSTEM privileges upon service startup.

The vulnerability carries a CVSS score of 7.8, reflecting a high-severity risk due to the potential for total system compromise. Successful exploitation grants an attacker full administrative control over the affected machine, enabling them to bypass security controls, install persistent backdoors, or access sensitive data. This poses a significant threat to organizational endpoint integrity.

Immediate Action: Administrators should uninstall the affected version of Acer Launch Manager if it is not required for system operation. If the software is necessary, ensure that the service configuration is manually updated to use a quoted path or verify if a vendor-supplied patch is available for your specific model.

Proactive Monitoring: Monitor system logs for unauthorized service creation or unexpected child processes spawned by services running under the SYSTEM account.

Compensating Controls: Implement strict file system permissions on the C:\ drive and specifically on the Program Files (x86) directory to prevent unauthorized users from creating or modifying files in high-level paths.

Public Exploit Available: Yes, a proof-of-concept exploit is available via Exploit-DB (EDB-ID 47577).

Given the availability of a public exploit and the high potential for privilege escalation, this vulnerability must be treated with urgency. Organizations should prioritize identifying and patching or removing instances of Acer Launch Manager 6.1.7600.16385 to eliminate the risk of local administrative takeover.