Acer vulnerabilities
We track 32 vulnerabilities in Acer products across 60+ products. 32 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Acer vulnerabilities
- 7.4 High severity
System Monitoring: Improper Access Control
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perform unauth
- 7.4 High severity
System Monitoring: Improper Access Control
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry o
- 7.4 High severity
Agent Serivce: Improper Access Control
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In c
- 8.5 High severity
Planet9 background service: Incorrect Permission Assignment for Critical Resource
A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background service. The service runs with SYSTEM privileges, while the affected executable grants excessive perm
- 9.8 Critical severity
Connect M6E 5G Portable WiFi Router: Insufficient Verification of Data Authenticity
The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.
- 7.5 High severity
Connect M6E 5G Portable WiFi Router: Use of Hard-coded Credentials
The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.
- 9.8 Critical severity
Connect M6E 5G Portable WiFi Router: Use of Externally-Controlled Format String
Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.
- 7.5 High severity
Connect M6E 5G Portable WiFi Router: Exposure of Sensitive Information to an Unauthorized Actor
The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.
- 7.8 High severity
Connect M6E 5G Portable WiFi Router: Incorrect Permission Assignment for Critical Resource
Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker.
- 9.4 Critical severity
Connect M6E 5G Portable WiFi Router: Use of Insufficiently Random Values
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic.
- 7.8 High severity
Connect M6E 5G Portable WiFi Router: Improper Limitation of a Pathname to a Restricted Directory
The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivity.
- 8.3 High severity
Connect M6E 5G Portable WiFi Router: Improper Authentication
Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.
- 8.6 High severity
Connect M6E 5G Portable WiFi Router: Improper Authentication
Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.
- 8.8 High severity
Connect M6E 5G Portable WiFi Router: Improper Authentication
The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface.
- 8.8 High severity
Connect M6E 5G Portable WiFi Router: Improper Neutralization of Special Elements used in an OS Command
The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.
- 9.8 Critical severity
Connect M6E 5G Portable WiFi Router: Active Debug Code
The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.
- 9.8 Critical severity
Connect M6E 5G Portable WiFi Router: Improper Authentication
The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.
- 9.8 Critical severity
Wave 7 router: Use of Hard-coded Credentials
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
- 9.8 Critical severity
Wave 7 router: Insertion of Sensitive Information into Log File
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.
- 9.8 Critical severity
Predator Connect W6x: Improper Authentication
Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.
- 8.8 High severity
Predator Connect W6x: Missing Authentication for Critical Functionality
Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands.
- 8.5 High severity
NitrorSense V3: Improper Limitation of a Pathname to a Restricted Directory
A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenti
- 8.5 High severity
NitrorSense V3: Improper Limitation of a Pathname to a Restricted Directory
NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated loc
- 7.8 High severity
PredatorSense V3: Improper Limitation of a Pathname to a Restricted Directory
PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authe
- 7.8 High severity
ListCheck.exe: Incorrect Authorization
ListCheck.exe developed by Acer has a Local Privilege Escalation vulnerability. Authenticated local attackers can replace ListCheck.exe with a malicious executable of the same name, which will be executed by the system and result in privilege escalation.
- 8.8 High severity
ControlCenter: Improper Privilege Management
Acer ControlCenter contains Remote Code Execution vulnerability. The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing remote users with low privileges to interact
- 7.8 High severity
Aspire E5-475g Firmware: Out-of-bounds Write
Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local attackers to execute arbitrary code in the UEFI DXE phase and gain escalated privileges.
- 8.2 High severity
Aspire A315-22: Incorrect Default Permissions
Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.
- 9.8 Critical severity
Altos W2000h-w570h F4 Firmware: Out-of-bounds Write
Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. This vulnerability allows attackers to cause a Denial of Service (DoS) via injecting crafted shellcode into the NVRAM variable.
- 7.8 High severity
Altos T110 F3 Firmware: Out-of-bounds Write
There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI D
- 7.8 High severity
Quickaccess: Improper Authentication
Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority through a named pipe. In this case, the Named Pipe is also given Re
- 7.8 High severity
Care Center: Improper Authentication
Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority called ACCsvc through a named pipe. In this case, the Named Pipe is also given Read and Write righ