Local Privilege Escalation Vulnerability in Acer Care Center by Acer
CVE-2022-24285

7.8HIGH

Key Information:

Vendor

Acer

Status
Care Center
Vendor
CVE Published:
8 March 2022

What is CVE-2022-24285?

Acer Care Center version 4.00.30xx prior to 4.00.3042 is affected by a local privilege escalation vulnerability. This vulnerability arises from the way a user process communicates with the ACCsvc system service using named pipes, which are incorrectly assigned Read and Write rights to general users. Furthermore, the service fails to validate user credentials during communication. As a result, an attacker could potentially exploit this flaw by sending a specific command to execute a program with system-level privileges, leading to unauthorized access and control over system resources.

References

https://community.acer.com/en/kb/articles/14761
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.