A local privilege escalation vulnerability in Acer ePowerSvc 6.0.3008.0 allows low-privileged users to execute code with LocalSystem permissions.

The application is susceptible to an unquoted service path vulnerability (CWE-428) in the service configuration. Because the path to the executable contains spaces and is not enclosed in quotes, a local attacker can place a malicious binary in a parent directory to be executed by the service with elevated privileges.

Successful exploitation of this vulnerability allows a local attacker to gain full control over the affected system by executing code with LocalSystem privileges. This bypasses standard user restrictions, potentially leading to total system compromise, data theft, and the installation of persistent malicious software. Given the CVSS score of 7.8, this poses a significant risk to host integrity and organizational security.

Immediate Action: Update the affected Acer software to the latest version provided by the vendor, or if a patch is unavailable, manually correct the service path configuration by adding quotes around the binary path in the Windows Registry.

Proactive Monitoring: Audit Windows services for unquoted service paths using tools like WMIC or PowerShell to identify other potentially vulnerable installations across the environment.

Compensating Controls: Restrict write permissions on the affected directory paths to ensure that only authorized administrators can modify files within the service installation folder.

Public Exploit Available: Yes, a technical write-up and proof-of-concept are available via the Exploit Database (EDB-ID: 49900).

This vulnerability represents a high-risk local privilege escalation vector that should be addressed immediately. Administrators should prioritize identifying all instances of the vulnerable service and applying the necessary configuration changes or vendor-supplied updates to prevent unauthorized elevation of privileges.