Acer Answers Security & Vulnerabilities

Misconfigured Windows Named Pipe Permissions in ACCSvc.exe allows for Remote Code Execution

VULNERABILITY DETAILS

Acer ControlCenter contains local privilege escalation vulnerability. This process exposes a Windows Named Pipe using a custom protocol to invoke functions within service. The aforementioned Named Pipe is misconfigured such that remote, unauthenticated users may interact with it, and by extension any features available over the Named Pipe. One feature of service is to invoke arbitrary executables as NT AUTHORITY\SYSTEM. Using this, remote attackers are able to run arbitrary code on remote hosts in a privileged context.

Impact Scope

Acer Control Center Software

Resolution

Acer has released a new version of Acer Control Center to address this concern. You can find the latest version of Acer Control Center for your device on our Drivers and Manuals site.

Credit

Acer thanks Leon Jacobs at Orange Cyber Defense for reporting this issue.

Disclaimer

THE ABOVE INFORMATION IS PROVIDED "AS IS" IN CONNECTION WITH ACER AND INTEL® PRODUCTS. YOUR USE OF THE INFORMATION OR MATERIALS LINKED FROM THIS PAGE IS AT YOUR OWN RISK. ACER RESERVES THE RIGHT TO CHANGE OR UPDATE THIS PAGE AT ANY TIME.

Swift Series Intel^® Evo™

Game Pass

Acer Corner

Gaming on Chromebook

Swift Series Intel® Evo™

Game Pass

Acer Corner

Gaming on Chromebook

Swift Series Intel^® Evo™