PT-2026-3281 · Acer · Acer Updater Service

Emmanuel Lujan · Publicado 2026-01-16 · Atualizado 2026-01-17 · CVE-2021-47825

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Acer Updater Service version 1.2.3500.0

Description The Acer Updater Service contains a flaw due to an unquoted service path. This allows local users to potentially execute code with elevated system privileges. An attacker can exploit the unquoted path located in 'C:Program FilesAcerAcer Updater' by injecting malicious executables. These executables will then run with LocalSystem permissions when the service starts.

Recommendations Apply appropriate quoting to the service path to prevent the execution of unauthorized code.

Exploit

Correção

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

CVE-2021-47825

Produtos afetados

Acer Updater Service

Referências · 6

• 🔥 https://exploit-db.com/exploits/49890 · Exploit
• https://twitter.com/RedPacketSec/status/2012332015366852836 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2012303218630607191 · Publicação no Twitter
• https://acer.com/ac/en/US/content/home · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-47825 · Nota de Segurança
• https://vulncheck.com/advisories/acer-updater-service-updaterserviceexe-unquoted-service-path · Nota