EUVD-2025-18228
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Acer ControlCenter contains Remote Code Execution vulnerability. The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing remote users with low privileges to interact with it and access its features. One such feature enables the execution of arbitrary programs as NT AUTHORITY/SYSTEM. By leveraging this, remote attackers can execute arbitrary code on the target system with elevated privileges.
Analysis
Remote code execution vulnerability in Acer ControlCenter that exploits a misconfigured Windows Named Pipe to allow authenticated attackers with low privileges to execute arbitrary code with SYSTEM-level permissions. The vulnerability has a CVSS score of 8.8 (High) and requires only network access and low privileges, making it a significant elevation-of-privilege vector; real-world exploitation likelihood depends on confirmation of active KEV listing and public exploit availability.
Technical Context
Acer ControlCenter uses a custom protocol over Windows Named Pipes (IPC mechanism for inter-process communication) to expose internal functionality. The root cause is CWE-269 (Improper Access Control), wherein the Named Pipe lacks proper access control restrictions, allowing unauthenticated or low-privileged network users to connect and invoke privileged operations. Named Pipes on Windows are kernel objects that can be configured with discretionary access control lists (DACLs); this implementation fails to restrict access to only high-privilege accounts or specific trusted processes. The custom protocol layer compounds this by not performing its own privilege validation before executing system commands. Affected product is Acer ControlCenter (specific versions not provided in CVE description alone; CPE data would clarify version range). The attack leverages the pipe's exposed command execution feature to run arbitrary binaries in the context of NT AUTHORITY/SYSTEM, which is the highest privilege level on Windows systems.
Affected Products
Acer ControlCenter (version range not specified in provided CVE description; CPE identifier required for exact version boundaries). Typical CPE format would be: cpe:2.3:a:acer:controlcenter:*:*:*:*:*:windows:*:* (with version constraints to be populated). Any Acer device running ControlCenter service exposed to network or accessible by low-privileged local users is potentially affected. Common affected platforms: Acer laptops, desktops, and workstations with ControlCenter pre-installed or auto-updated. No vendor advisory link provided in CVE description; recommend checking Acer's official security bulletins and NIST NVD for linked advisories.
Remediation
PATCH: Update Acer ControlCenter to a patched version (specific patch version not provided in CVE description; obtain from Acer's official security advisory or automatic update mechanism). WORKAROUND (if patch unavailable): (1) Restrict network access to ControlCenter's Named Pipe by implementing Windows Firewall rules or network segmentation to block untrusted sources. (2) Configure the Named Pipe's DACL (Discretionary Access Control List) via Windows Registry or Group Policy to deny access to low-privilege accounts and anonymous users; escalate pipe ownership to a dedicated high-privilege service account. (3) Disable ControlCenter service if not required. (4) Apply principle of least privilege: run affected systems with minimal necessary permissions. (5) Monitor for suspicious Named Pipe access using Windows Event Tracing or Sysmon. MITIGATION: Isolate affected Acer devices from untrusted networks, enforce multi-factor authentication for network access, and segment administrative access. Reference vendor advisory at Acer's security page (URL not provided; check acer.com/support or security.acer.com for CVE-2025-5491 advisory).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today