Acer NitroSense V3 versions before 3.01.3052 contain a misconfigured Windows Named Pipe that exposes a custom protocol to invoke internal functions. The named pipe incorrectly grants any authenticated local user the ability to execute arbitrary code with the privileges of NT AUTHORITY\SYSTEM and to delete any files with SYSTEM ownership. This flaw enables the attacker to run code with elevated privileges, effectively taking full control of the affected system.

The vulnerability affects the Acer NitroSense V3 product line. All releases of NitroSense 3.x prior to the fixed version 3.01.3056 are impacted. Users of version 3.01.3052 through 3.01.3055 and earlier releases are therefore at risk.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, which does not provide additional insight into the likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Local exploit requires an authenticated user; the attack vector is therefore local and requires the attacker to be logged on to the affected machine.