An incorrect permission assignment vulnerability in the Acer Planet9 background service allows local attackers to escalate privileges to SYSTEM.

This vulnerability, classified as CWE-732, involves incorrect file permissions assigned to an executable used by the Planet9 background service. Because the service operates with SYSTEM privileges, a local, authenticated user can leverage these weak permissions to gain full administrative control over the host.

The ability for a local user to gain SYSTEM privileges represents a severe security compromise. An attacker could install malicious software, modify system configurations, or access sensitive data, leading to a total loss of confidentiality, integrity, and availability on the affected host. Given the CVSS score of 8.5, this is a high-risk flaw that should be addressed immediately to prevent lateral movement or total system takeover.

Immediate Action: Ensure that the Planet9 background service has been automatically updated, which removes the vulnerable executable files and uninstalls the PLANET9DAService.

Proactive Monitoring: Review system access logs for unauthorized attempts to modify service executables or unusual process execution patterns under the SYSTEM account.

Compensating Controls: Restrict local user access to the file system where application executables are stored, and enforce the principle of least privilege for all non-administrative accounts on the endpoint.

Public Exploit Available: false

The risk of local privilege escalation to SYSTEM status is severe and requires prompt attention. IT administrators should verify that the automatic update has successfully removed the vulnerable components. If the automated process fails, manual intervention is required to uninstall the affected service to neutralize the threat.