EUVD-2025-18228Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Acer ControlCenter contains Remote Code Execution vulnerability. The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing remote users with low privileges to interact with it and access its features. One such feature enables the execution of arbitrary programs as NT AUTHORITY/SYSTEM. By leveraging this, remote attackers can execute arbitrary code on the target system with elevated privileges.
AnalysisAI
Remote code execution vulnerability in Acer ControlCenter that exploits a misconfigured Windows Named Pipe to allow authenticated attackers with low privileges to execute arbitrary code with SYSTEM-level permissions. The vulnerability has a CVSS score of 8.8 (High) and requires only network access and low privileges, making it a significant elevation-of-privilege vector; real-world exploitation likelihood depends on confirmation of active KEV listing and public exploit availability.
Technical ContextAI
Acer ControlCenter uses a custom protocol over Windows Named Pipes (IPC mechanism for inter-process communication) to expose internal functionality. The root cause is CWE-269 (Improper Access Control), wherein the Named Pipe lacks proper access control restrictions, allowing unauthenticated or low-privileged network users to connect and invoke privileged operations. Named Pipes on Windows are kernel objects that can be configured with discretionary access control lists (DACLs); this implementation fails to restrict access to only high-privilege accounts or specific trusted processes. The custom protocol layer compounds this by not performing its own privilege validation before executing system commands. Affected product is Acer ControlCenter (specific versions not provided in CVE description alone; CPE data would clarify version range). The attack leverages the pipe's exposed command execution feature to run arbitrary binaries in the context of NT AUTHORITY/SYSTEM, which is the highest privilege level on Windows systems.
RemediationAI
PATCH: Update Acer ControlCenter to a patched version (specific patch version not provided in CVE description; obtain from Acer's official security advisory or automatic update mechanism). WORKAROUND (if patch unavailable): (1) Restrict network access to ControlCenter's Named Pipe by implementing Windows Firewall rules or network segmentation to block untrusted sources. (2) Configure the Named Pipe's DACL (Discretionary Access Control List) via Windows Registry or Group Policy to deny access to low-privilege accounts and anonymous users; escalate pipe ownership to a dedicated high-privilege service account. (3) Disable ControlCenter service if not required. (4) Apply principle of least privilege: run affected systems with minimal necessary permissions. (5) Monitor for suspicious Named Pipe access using Windows Event Tracing or Sysmon. MITIGATION: Isolate affected Acer devices from untrusted networks, enforce multi-factor authentication for network access, and segment administrative access. Reference vendor advisory at Acer's security page (URL not provided; check acer.com/support or security.acer.com for CVE-2025-5491 advisory).
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-269 – Improper Privilege Management
View allShare
External POC / Exploit Code
Leaving vuln.today