CVE-2026-9789

CVE ID: CVE-2026-9789
Researcher: Vo Duc Thang (ugvxb)
Acknowledgement: https://community.acer.com/en/kb/articles/19670
Video POC: https://drive.google.com/file/d/1B8b42bE68CWMnlqG6eJWi0txGFsHAJZc/view?usp=sharing

1. Executive Summary

A critical local privilege escalation vulnerability has been discovered in Acer NitroSense software (PSAdminAgent.exe). The vulnerability allows any authenticated local user to delete arbitrary files with SYSTEM privileges, potentially leading to complete system compromise through security software bypass.

2. Vulnerability Details

2.1 Overview

The PSAdminAgent.exe service creates a named pipe with an overly permissive Access Control List (ACL) that allows any authenticated user to connect and send commands. The service processes file deletion commands without validating the caller's privileges or restricting the target paths. Since the service runs with SYSTEM privileges, this allows any local user to delete arbitrary files as SYSTEM.

2.2 Root Cause Analysis

Issue 1: Weak Named Pipe ACL

The named pipe is created with the following Security Descriptor Definition Language (SDDL) string:

D:(A;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)

Decoded:

Issue 2: No Path Validation

The delete_file command handler passes user-supplied paths directly to the Windows DeleteFileW API without any validation or restriction.

Issue 3: No Caller Authentication

The service does not verify that the connecting client is an authorized Acer application, allowing any process to send commands.

3. Affected Commands

Based on reverse engineering analysis, the following command is confirmed exploitable:

3.1 Vulnerable Function Locations (PSAdminAgent.exe)

3.2 SDDL String Location

Address: 0x140059810

D:(A;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)

3.3 Command Dispatch Table

Address: 0x140057950

[0x00] -> 0x140009080
[0x01] -> 0x140009310
[0x02] -> 0x1400093a0
[0x03] -> 0x1400094e0  (delete_file) <- CONFIRMED VULNERABLE
[0x04] -> 0x140009610
[0x05] -> 0x1400097c0
...
[0x0E] -> 0x14000a950

3.4 Confirmed Vulnerable Code Path

PSAdminAgent.exe
    -> Named Pipe: \\.\pipe\PredatorSense_admin_agent_X
        -> Command Handler (0x140008d14)
            -> CMD 0x0003: delete_file (0x1400094e0)
                -> DeleteFileW(user_supplied_path)  <- NO VALIDATION

4. Risk Assessment

4.1 CVSS v4.0 Score

5. References

• CWE-732: https://cwe.mitre.org/data/definitions/732.html
• CWE-284: https://cwe.mitre.org/data/definitions/284.html
• CWE-22: https://cwe.mitre.org/data/definitions/22.html
• CWE-269: https://cwe.mitre.org/data/definitions/269.html

6. Disclaimer

This poc is for educational and authorized security research purposes only. The author is not responsible for any misuse. Exploitation without authorization is illegal.