EUVD-2026-31619
GHSA-x6vp-3m75-76c9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryConnect to NitroSense Named Pipe
-
ExploitSend crafted custom-protocol invocation
-
ExecutionTrigger SYSTEM code execution or file delete
-
ImpactGain NT AUTHORITY\SYSTEM control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have an authenticated local session on a Windows machine where a vulnerable NitroSense 3.x (3.01.3001 through 3.01.3052) is installed and its privileged service/Named Pipe is running - the specific prerequisite is the ability to open and write the custom protocol to NitroSense's exposed, misconfigured Windows Named Pipe. Limiting factors: the attack vector is local only (AV:L), so no remote/network exploitation is possible; a valid low-privileged account (PR:L) is needed; and only systems with NitroSense installed (predominantly Acer Nitro/Predator gaming laptops) are exposed. No user interaction is required (UI:N) and no non-default configuration is needed beyond NitroSense simply being installed and running. |
| Impact | Signals are internally consistent and point to a genuine but locally-scoped risk. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N, VC/VI/VA:H, score 8.5) describes a low-complexity local attack requiring only low privileges and no user interaction, yielding full confidentiality, integrity and availability impact - matching the SSVC 'Technical Impact: total' rating. Counterbalancing this, the attack vector is strictly local (AV:L), EPSS is only 0.02% (6th percentile), SSVC 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing and no public exploit identified, so this is a real escalation primitive rather than a mass-exploited internet-facing bug. The practical priority is moderate: high value to an attacker who already has a foothold on an Acer laptop (a reliable path to SYSTEM), but low likelihood of widespread opportunistic exploitation. No conflicting data was observed; the CVSS local vector, description, and SSVC all agree that a pre-existing authenticated local session is the gating condition. |
| Exploit ScenarioDerived | An attacker with an ordinary authenticated account on an Acer laptop (for example malware running in a standard user's session, or a low-privileged insider) connects to the NitroSense Named Pipe and sends crafted custom-protocol messages that invoke the exposed internal functions. Using the arbitrary-code-execution primitive they launch a payload as NT AUTHORITY\SYSTEM, or use the arbitrary-file-delete primitive to remove protected files, achieving full SYSTEM control from a low-privileged starting point. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) makes a reliable exploit straightforward to develop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local privilege escalation in Acer NitroSense 3.x before 3.01.3052 allows any authenticated local user to run arbitrary code as NT AUTHORITY\SYSTEM and delete arbitrary files with SYSTEM rights by abusing a misconfigured Windows Named Pipe that exposes internal functions through a custom protocol. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.02%), but SSVC rates technical impact as total, making this a high-value local escalation on affected Acer gaming laptops. Authentication requirements per the CVSS 4.0 vector are PR:L, so a low-privileged but authenticated local account is sufficient.
RemediationAI
Vendor-released patch: update NitroSense to version 3.01.3052 or later, which corrects the Named Pipe misconfiguration; follow the vendor instructions in Acer's advisory at https://community.acer.com/en/kb/articles/19652 (see also https://nvd.nist.gov/vuln/detail/CVE-2026-9489). Because exploitation requires an authenticated local session, interim compensating controls where immediate patching is not possible include restricting interactive local logon to trusted users, uninstalling or disabling the NitroSense service on systems that do not need its hardware-control features (trade-off: loss of fan/performance/keyboard-lighting management), and monitoring for unexpected processes spawned by the NitroSense service or anomalous connections to its Named Pipe. If feasible, applying a tightened security descriptor/ACL to the pipe would help, but this is fragile and may break the client-service communication, so upgrading to 3.01.3052 remains the reliable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NitroSense is Acer's system-management and hardware-control utility bundled on Nitro/Predator gaming laptops; it runs a privileged background service that clients communicate with over a Windows Named Pipe using a custom protocol to invoke internal functions. The vulnerability stems from the pipe's access-control/security-descriptor being misconfigured so that any authenticated local user, rather than only the privileged service or administrators, can connect and invoke those SYSTEM-level functions. Although classified as CWE-22 (Path Traversal) - reflected in the arbitrary-file-delete-with-SYSTEM primitive where attacker-controlled paths are not properly constrained - the root cause is really an over-permissive IPC endpoint that exposes powerful operations to unprivileged callers, combining path traversal with a broken privilege boundary. The single affected component is identified in CPE as cpe:2.3:a:acer:nitrorsense_v3:*:*:*:*:*:*:*:* (NitrorSense V3).
Know when Nitrorsense V3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Authenticated local user abuses a local Named Pipe with low complexity and no user interaction (AV:L/AC:L/PR:L/UI:N), gaining SYSTEM code execution for full C/I/A impact with no scope change.
Primary rating from Vendor (Acer).
CVSS VectorVendor: Acer
Lifecycle Timeline
2DescriptionCVE.org
NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.
Executive ViewAI
A local privilege escalation vulnerability in Acer NitroSense versions 3.x before 3.01.3052 allows authenticated local users to escalate to SYSTEM rights and execute arbitrary code. This affects organizations with Acer gaming laptops; insider threats or compromised employee accounts could lead to complete system compromise and data exfiltration.
No vendor-released patch identified at time of analysis. Restrict NitroSense service execution to administrative users via Group Policy Object; disable NitroSense entirely on endpoints where gaming functionality is not required; enforce strong local account access controls and multi-factor authentication to limit the authenticated user prerequisite; implement endpoint detection and response monitoring for Windows Named Pipe access anomalies, unexpected SYSTEM-level process spawning from NitroSense, and suspicious file deletion operations; consider disabling the service by default and implementing application whitelisting policies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB