A Local Privilege Escalation vulnerability in Acer NitroSense affects versions before 3.01.3052. The PSAdminAgent service creates a named pipe with a weak ACL, allowing any authenticated local user to connect and send commands. Because the service does not verify caller privileges before executing file deletion commands, an attacker can delete arbitrary files with system authority. The weakness maps to CWE‑22 (Path Traversal), CWE‑269 (Privilege Escalation), CWE‑284 (Improper Access Control), and CWE‑732 (Incorrect Permission Assignment).

Affected systems are Acer NitroSense V3 devices running software prior to version 3.01.3052. Only those installations that have the PSAdminAgent service enabled are vulnerable; newer releases include the fix. No other vendors or product lines are listed as affected.

The risk is significant with a CVSS score of 8.5, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the local attack requirement means that any authenticated user on a compromised or trusted machine can exploit the flaw. The exploit path is straightforward: the attacker creates a named pipe connection, sends a malicious command, and the service deletes the target file with system privileges. The lack of privilege checks makes exploitation easy for skilled users.