Agent Serivce
Monthly
Local privilege escalation in the Acer Agent Service bundled with Acer NitroSense and PredatorSense lets an authenticated local user on an affected Windows laptop perform unauthorized registry operations through insufficiently controlled access in the service, potentially obtaining higher privileges and compromising the machine. The issue is rated CVSS 7.4 (CVSS v4.0 AV:L/AC:L/AT:N/PR:L/UI:N with High impact across confidentiality, integrity and availability, including subsequent-system impact), and our assessment aligns with a CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so the practical prerequisite is that the attacker already holds a low-privilege local account on a host where the OEM utility and its privileged service are installed and running. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV (the v4.0 vector carries E:U, 'Unproven' exploit maturity), so this is a genuine local privilege-escalation issue but not an urgent, mass-exploitable one; no EPSS score was supplied in the source data.
Local privilege escalation in the Acer Agent Service bundled with Acer NitroSense and PredatorSense lets an authenticated local user on an affected Windows laptop perform unauthorized registry operations through insufficiently controlled access in the service, potentially obtaining higher privileges and compromising the machine. The issue is rated CVSS 7.4 (CVSS v4.0 AV:L/AC:L/AT:N/PR:L/UI:N with High impact across confidentiality, integrity and availability, including subsequent-system impact), and our assessment aligns with a CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so the practical prerequisite is that the attacker already holds a low-privilege local account on a host where the OEM utility and its privileged service are installed and running. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV (the v4.0 vector carries E:U, 'Unproven' exploit maturity), so this is a genuine local privilege-escalation issue but not an urgent, mass-exploitable one; no EPSS score was supplied in the source data.