Acer NitrorSense up to 3.01.3052 path traversal

Summaryinfo

A vulnerability, which was classified as critical, has been found in Acer NitrorSense up to 3.01.3052. The impacted element is an unknown function. The manipulation leads to path traversal. This vulnerability is documented as CVE-2026-9489. The attack needs to be performed locally. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Acer NitrorSense up to 3.01.3052. It has been rated as critical. This issue affects an unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.

The weakness was released by Artem Domarev. It is possible to read the advisory at community.acer.com. The identification of this vulnerability is CVE-2026-9489 since 05/25/2026. The exploitation is known to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 3.01.3052 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31619). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Acer

Name

• NitrorSense

Version

• 3.01.3052

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion