PT-2026-42992 · Acer · Nitrorsense V3

Artem Domarev · Published 2026-05-25 · Updated 2026-05-25 · CVE-2026-9489

Mitre

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITYSYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.

Fix

Improper Access Control

Improper Privilege Management

Path traversal

Incorrect Permission

Weakness Enumeration

CWE-284

CWE-269

CWE-22

CWE-732

Related Identifiers

CVE-2026-9489

Affected Products

Nitrorsense V3

References · 1

• https://community.acer.com/en/kb/articles/19652 · Note