Planet9 Background Service
Monthly
Local privilege escalation in Acer's Planet9 software allows an authenticated local user to achieve arbitrary code execution with SYSTEM privileges by exploiting overly permissive file ACLs on the Planet9 background service executable. The service runs as SYSTEM but the executable it invokes grants write access to non-administrative users, enabling binary replacement. When the service restarts or the host reboots, the attacker-controlled payload executes with full SYSTEM authority. No public exploit has been identified at time of analysis, and this is not listed in the CISA KEV catalog.
Local privilege escalation in Acer's Planet9 software allows an authenticated local user to achieve arbitrary code execution with SYSTEM privileges by exploiting overly permissive file ACLs on the Planet9 background service executable. The service runs as SYSTEM but the executable it invokes grants write access to non-administrative users, enabling binary replacement. When the service restarts or the host reboots, the attacker-controlled payload executes with full SYSTEM authority. No public exploit has been identified at time of analysis, and this is not listed in the CISA KEV catalog.