A local privilege escalation vulnerability in the Acer Updater Service allows attackers to execute arbitrary code with LocalSystem permissions.

The application utilizes an unquoted service path for the UpdaterService.exe binary. A local user can exploit this weakness by placing a malicious executable in the directory structure, which the service will inadvertently execute with elevated LocalSystem privileges upon startup.

Successful exploitation of this vulnerability grants an attacker full control over the affected system. Because the malicious code runs with LocalSystem privileges, the attacker can bypass standard security restrictions, install persistent backdoors, or exfiltrate sensitive data. With a CVSS score of 7.8, this represents a significant risk to the confidentiality, integrity, and availability of any workstation or server running the vulnerable service.

Immediate Action: Update the Acer Updater Service to a patched version if available, or uninstall the service if it is not required for system operations. If an update is not immediately feasible, ensure that non-administrative users do not have write permissions to the C:\Program Files\Acer\ directory.

Proactive Monitoring: Review system logs for unexpected service restarts or the creation of new executable files within the Acer installation directory. Monitor for unauthorized processes running under the LocalSystem account.

Compensating Controls: Implement strict file system permissions (Access Control Lists) to prevent unprivileged users from writing files to the path C:\Program Files\Acer. This prevents the injection of malicious binaries required to trigger the exploit.

Public Exploit Available: Yes, a proof-of-concept exists as documented on Exploit-DB (EDB-ID 49890).

Given the ease with which local users can escalate their privileges to LocalSystem, this vulnerability should be treated with high priority. Organizations should audit their device fleets to identify systems running the vulnerable version of the Acer Updater Service and prioritize the application of vendor-supplied patches or the removal of the service to eliminate the attack surface.