A critical unquoted service path vulnerability in Acer Global Registration Service allows local attackers to achieve privilege escalation to LocalSystem.

The application utilizes an unquoted service path for the GREGsvc.exe executable, which creates a flaw where the Windows service control manager may incorrectly interpret the path. A local user with sufficient permissions can place a malicious executable in a specific directory along the path, which will subsequently be executed with elevated LocalSystem privileges upon service startup.

Successful exploitation of this vulnerability grants a local attacker full administrative control over the affected system. This presents a severe risk of data exfiltration, malware installation, and long-term persistence within the environment. While the CVSS score of 7.8 indicates a high severity, the ability to escalate privileges to the highest level of system access makes this a priority for remediation on all affected endpoints.

Immediate Action: Update the Acer Global Registration Service to the latest available version provided by the vendor, or remove the software if it is not required for business operations.

Proactive Monitoring: Monitor system logs for the creation of unauthorized executables in the C:\Program Files (x86)\ directory or subdirectories associated with vendor services.

Compensating Controls: Administrators can manually remediate this issue by using the sc config command to reconfigure the service path with proper quoting or by modifying the Registry key associated with the service to include quotes around the binary path.

Public Exploit Available: Yes, an ExploitDB entry exists (EDB-ID 49142).

Given the availability of a public proof-of-concept and the potential for full system compromise, this vulnerability poses a significant risk to internal security. Organizations should audit their device fleets to identify instances of the Acer Global Registration Service and apply the necessary configuration changes or software updates immediately to prevent local privilege escalation.