A local privilege escalation vulnerability in Acer Backup Manager 3.0.0.99 allows attackers to achieve arbitrary code execution with LocalSystem privileges.

The software contains an unquoted service path vulnerability (CWE-428) in the NTI IScheduleSvc service. A local, authenticated attacker can exploit this by placing a malicious executable in the service path, which the system will then execute with elevated LocalSystem privileges upon service startup.

The ability for a local user to escalate privileges to the LocalSystem level represents a critical security failure. An attacker who has achieved initial low-privileged access to a workstation can leverage this vulnerability to gain full control over the operating system, potentially leading to the theft of sensitive data, installation of persistent backdoors, or the deployment of ransomware. While the CVSS score is 7.8, the potential for total system compromise makes this a high-priority risk for any environment where this software is deployed.

Immediate Action: Administrators should uninstall or update the affected version of Acer Backup Manager. If an update is not available, the service should be disabled or the service path should be manually quoted in the Windows Registry to prevent the hijacking attempt.

Proactive Monitoring: Review Windows system event logs for service startup failures or unexpected executable launches originating from the NTI directory. Monitor for the creation of new, unauthorized files within the C:\Program Files (x86)\NTI\ directory.

Compensating Controls: Implement strict file system permissions on the application installation directory to prevent non-administrative users from writing or modifying files. Ensure that Endpoint Detection and Response (EDR) solutions are configured to alert on unauthorized attempts to create files in protected system folders.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit Database (EDB-ID: 49889).

Given the ease of exploitation and the potential for full system compromise, organizations should prioritize the identification and remediation of all instances of Acer Backup Manager 3.0.0.99. If the software is no longer required, removal is the most effective security measure. Otherwise, ensure that standard users are restricted from modifying the installation directory and apply configuration changes to the service path as a temporary mitigation until a vendor-supplied patch is applied.