Acer Agent Service
Monthly
Local unauthenticated access to the Acer Agent Service - the background component shipped with Acer's NitroSense and PredatorSense utilities on Nitro and Predator Windows laptops - allows any user or piece of malware already running on the host to open a connection to the service socket and reach functionality that should be restricted, because the socket handshake never verifies the caller's identity (CWE-306). Rated CVSS 4.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H) and scored by our assessment as CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, the flaw is not remotely reachable and requires the Acer software to be installed, with the vendor description noting the unauthenticated handshake path succeeds only 'under certain circumstances.' No public exploit has been identified at time of analysis, and the practical exposure is a local privilege/functionality boundary bypass rather than an internet-facing emergency.
Local attackers with access to an Acer Nitro or Predator laptop can recover a hard-coded AES key used by the Acer Agent Service, a component bundled with NitroSense and PredatorSense, allowing access to protected information or unauthorized actions. The vulnerability is rated CVSS 4.9 and is not known to be actively exploited; no public exploit was identified at time of analysis, and the vendor marks exploit maturity as Unproven. Because the key is identical across installations, any local copy of the affected software can expose it.
Local unauthenticated access to the Acer Agent Service - the background component shipped with Acer's NitroSense and PredatorSense utilities on Nitro and Predator Windows laptops - allows any user or piece of malware already running on the host to open a connection to the service socket and reach functionality that should be restricted, because the socket handshake never verifies the caller's identity (CWE-306). Rated CVSS 4.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H) and scored by our assessment as CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, the flaw is not remotely reachable and requires the Acer software to be installed, with the vendor description noting the unauthenticated handshake path succeeds only 'under certain circumstances.' No public exploit has been identified at time of analysis, and the practical exposure is a local privilege/functionality boundary bypass rather than an internet-facing emergency.
Local attackers with access to an Acer Nitro or Predator laptop can recover a hard-coded AES key used by the Acer Agent Service, a component bundled with NitroSense and PredatorSense, allowing access to protected information or unauthorized actions. The vulnerability is rated CVSS 4.9 and is not known to be actively exploited; no public exploit was identified at time of analysis, and the vendor marks exploit maturity as Unproven. Because the key is identical across installations, any local copy of the affected software can expose it.