PT-2026-42992 · Acer · Nitrosense

Artem Domarev · CVE-2026-9489 · Published 2026-05-25 · Updated 2026-05-25

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NitroSense versions 3.x through 3.01.3051

Description The software contains a Local Privilege Escalation (LPE) issue where a Windows Named Pipe, which uses a custom protocol to invoke internal functions, is misconfigured. This allows any authenticated local user to execute arbitrary code and delete arbitrary files with NT AUTHORITYSYSTEM privileges, leading to full system compromise with elevated privileges.

Recommendations Update to version 3.01.3052.

Fix

LPE

Incorrect Permission

Path traversal

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-732

CWE-22

CWE-284

CWE-269

Related Identifiers

CVE-2026-9489

Affected Products

Nitrosense

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9489 · Security Note
• https://t.me/CVEtracker/54811 · Telegram Post
• https://community.acer.com/en/kb/articles/19652 · Note