Acer vulnerabilities
68 vulnerabilities
Known vulnerabilities in Acer products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 79 products.
Products
50 of 79- Connect M6E 5G26 vulnerabilities
- Connect M6E 5G Portable Wifi Router26 vulnerabilities
- Predator Connect W6X5 vulnerabilities
- System Monitoring5 vulnerabilities
- Care Center3 vulnerabilities
- Agent Service2 vulnerabilities
- Nitrorsense V32 vulnerabilities
- Nitrosense V52 vulnerabilities
- Wave 72 vulnerabilities
- Wave 7 Router2 vulnerabilities
- Ac700 Chromebook1 vulnerabilities
- Acer Backup Manager Module1 vulnerabilities
- Acer Portal1 vulnerabilities
- Acer Updater Service1 vulnerabilities
- Agent Serivce1 vulnerabilities
- Altos R680 F41 vulnerabilities
- Altos R680S F41 vulnerabilities
- Altos T110 F31 vulnerabilities
- Altos W2000H W570H F41 vulnerabilities
- Ap130 F21 vulnerabilities
- Aspire 1600X1 vulnerabilities
- Aspire 1602M1 vulnerabilities
- Aspire 7600U1 vulnerabilities
- Aspire A115 211 vulnerabilities
- Aspire A315 221 vulnerabilities
- Aspire A315 22G1 vulnerabilities
- Aspire C22 16001 vulnerabilities
- Aspire E5 475G1 vulnerabilities
- Aspire Mc6051 vulnerabilities
- Aspire S 271 vulnerabilities
- Aspire S32 18561 vulnerabilities
- Aspire Tc 1051 vulnerabilities
- Aspire Tc 1201 vulnerabilities
- Aspire U5 6201 vulnerabilities
- Aspire X19351 vulnerabilities
- Aspire X34751 vulnerabilities
- Aspire X39951 vulnerabilities
- Aspire Xc 17101 vulnerabilities
- Aspire Xc1001 vulnerabilities
- Aspire Xc6001 vulnerabilities
- Aspire Z3 6151 vulnerabilities
- C24 16551 vulnerabilities
- C24 9621 vulnerabilities
- Controlcenter1 vulnerabilities
- Epowersvc1 vulnerabilities
- Extensa Ex215 211 vulnerabilities
- Extensa Ex215 21G1 vulnerabilities
- Global Registration Service1 vulnerabilities
- Launch Manager1 vulnerabilities
- Listcheck.Exe1 vulnerabilities
CVE-2021-47826aceracer backup manager module
EPSS score0.17%
Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\NTI\Acer Backup Manager\ to inject malicious executables that would run with elevated LocalSystem privileges.CVE-2021-47825aceracer updater serviceEPSS score0.17%
Acer Updater Service 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code with elevated system privileges. Attackers can exploit the unquoted path in C:\Program Files\Acer\Acer Updater\ to inject malicious executables that will run with LocalSystem permissions during service startup.CVE-2021-47823acerepowersvcEPSS score0.17%
Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem permissions during service startup.CVE-2021-45975acercare_centerEPSS score0.60%
In ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading mechanism of Windows DLLs could allow a local attacker to perform a DLL hijacking attack. This vulnerability is due to incorrect handling of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on the targeted system. This file will execute when the vulnerable application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with local administrator privileges.CVE-2016-5648aceracer_portalEPSS score1.17%
Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate.CVE-2025-14305acerlistcheck.exeEPSS score0.12%
ListCheck.exe developed by Acer has a Local Privilege Escalation vulnerability. Authenticated local attackers can replace ListCheck.exe with a malicious executable of the same name, which will be executed by the system and result in privilege escalation.CVE-2025-5491acercontrolcenterEPSS score0.73%
Acer ControlCenter contains Remote Code Execution vulnerability. The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing remote users with low privileges to interact with it and access its features. One such feature enables the execution of arbitrary programs as NT AUTHORITY/SYSTEM. By leveraging this, remote attackers can execute arbitrary code on the target system with elevated privileges.CVE-2020-36976acerglobal registration serviceEPSS score0.18%
Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\Acer\Registration\ to inject malicious executables that would run with elevated LocalSystem privileges during service startup.CVE-2022-40080aceraspire_e5-475g_firmwareEPSS score0.36%
Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local attackers to execute arbitrary code in the UEFI DXE phase and gain escalated privileges.CVE-2022-41415aceraltos_w2000h-w570h_f4_firmwareEPSS score1.11%
Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. This vulnerability allows attackers to cause a Denial of Service (DoS) via injecting crafted shellcode into the NVRAM variable.CVE-2022-4020aceraspire_a115-21_firmware+4EPSS score0.25%
Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.CVE-2022-24286acerquickaccessEPSS score0.22%
Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority through a named pipe. In this case, the Named Pipe is also given Read and Write rights to the general user. In addition, the service program does not verify the user when communicating. A thread may exist with a specific command. When the path of the program to be executed is sent, there is a local privilege escalation in which the service program executes the path with system privileges.CVE-2022-24285acercare_centerEPSS score0.22%
Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority called ACCsvc through a named pipe. In this case, the Named Pipe is also given Read and Write rights to the general user. In addition, the service program does not verify the user when communicating. A thread may exist with a specific command. When the path of the program to be executed is sent, there is a local privilege escalation in which the service program executes the path with system privileges.CVE-2022-30426aceraltos_t110_f3_firmware+33EPSS score0.38%
There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version <= P13 (latest) and AP130 F2 firmware version <= P04 (latest) and Aspire 1600X firmware version <= P11.A3L (latest) and Aspire 1602M firmware version <= P11.A3L (latest) and Aspire 7600U firmware version <= P11.A4 (latest) and Aspire MC605 firmware version <= P11.A4L (latest) and Aspire TC-105 firmware version <= P12.B0L (latest) and Aspire TC-120 firmware version <= P11-A4 (latest) and Aspire U5-620 firmware version <= P11.A1 (latest) and Aspire X1935 firmware version <= P11.A3L (latest) and Aspire X3475 firmware version <= P11.A3L (latest) and Aspire X3995 firmware version <= P11.A3L (latest) and Aspire XC100 firmware version <= P11.B3 (latest) and Aspire XC600 firmware version <= P11.A4 (latest) and Aspire Z3-615 firmware version <= P11.A2L (latest) and Veriton E430G firmware version <= P21.A1 (latest) and Veriton B630_49 firmware version <= AAP02SR (latest) and Veriton E430 firmware version <= P11.A4 (latest) and Veriton M2110G firmware version <= P21.A3 (latest) and Veriton M2120G fir.CVE-2012-3290acerac700_chromebook+5EPSS score0.68%
Multiple unspecified vulnerabilities in Google Chrome before 20.0.1132.22 on the Acer AC700; Samsung Series 5, 5 550, and Chromebox 3; and Cr-48 Chromebook platforms have unknown impact and attack vectors.CVE-2024-8105aceraltos r680 f4+742EPSS score0.27%
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.CVE-2019-25302acerlaunch managerEPSS score0.15%
Acer Launch Manager 6.1.7600.16385 contains an unquoted service path vulnerability in the DsiWMIService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Launch Manager\dsiwmis.exe to insert malicious code that would execute with system-level permissions during service startup.CVE-2019-18670acerquick_accessEPSS score0.82%
In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an arbitrary unsigned DLL into the signed service's process, which is running as NT AUTHORITY\SYSTEM. This is a DLL Hijacking vulnerability (including search order hijacking, which searches for the missing DLL in the PATH environment variable), which is caused by an uncontrolled search path element for nvapi.dll, atiadlxx.dll, or atiadlxy.dll.CVE-2026-9789acernitrorsense v3EPSS score0.15%
A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenticated local user to connect and send commands. Because the service does not check the caller's privileges before running file deletion commands, a low-privileged local user can exploit this to delete arbitrary files with system authority.CVE-2026-9490acercare_centerEPSS score0.12%
A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.