CVE-2019-25302: Acer Launch Manager Privilege Escalation

CVE-2019-25302 Overview

CVE-2019-25302 is an unquoted service path vulnerability in Acer Launch Manager 6.1.7600.16385. The flaw resides in the DsiWMIService (dsiwmis.exe) service, which registers its executable path without surrounding quotation marks. Local attackers with low-privilege access can place a malicious binary along the unquoted path. Windows then loads that binary with SYSTEM privileges when the service starts. The weakness is tracked as [CWE-428: Unquoted Search Path or Element].

Critical Impact
Local attackers can escalate privileges to SYSTEM by planting an executable along the unquoted service path of C:\Program Files (x86)\Launch Manager\dsiwmis.exe.

Affected Products

Acer Launch Manager 6.1.7600.16385
Systems with the DsiWMIService (dsiwmis.exe) installed
Acer consumer notebooks shipped with Launch Manager preinstalled

Discovery Timeline

2026-02-06 - CVE-2019-25302 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2019-25302

Vulnerability Analysis

The vulnerability stems from how Acer Launch Manager registers its Windows service. The DsiWMIService is configured with an unquoted ImagePath value pointing to C:\Program Files (x86)\Launch Manager\dsiwmis.exe. Because the path contains spaces and lacks surrounding quotes, Windows parses each space-delimited segment as a potential executable target during service start.

The Service Control Manager attempts to launch candidates such as C:\Program.exe, C:\Program Files.exe, and C:\Program Files (x86)\Launch.exe before reaching the intended binary. An attacker who can write to any of these locations supplies an executable that runs in the service's security context.

Because DsiWMIService runs as LocalSystem by default, successful exploitation yields full administrative control of the host. The attack falls into the local privilege escalation category and aligns with [CWE-428].

Root Cause

The installer registers the service without enclosing the binary path in quotation marks. Windows service path parsing rules treat spaces as argument separators when quotes are missing. The default ACLs on C:\ and C:\Program Files (x86)\ historically permitted standard users to create files in some configurations, which enables the attack when those permissions are misconfigured.

Attack Vector

An authenticated local user identifies the unquoted service path by querying service configuration through sc qc DsiWMIService or wmic service. The attacker writes a malicious executable named Launch.exe to C:\Program Files (x86)\ or Program.exe to C:\, depending on writable directories. When the host reboots or the service is restarted, the planted binary executes as SYSTEM. No remote network access is required, and user interaction is not needed beyond initial code drop. Exploit techniques are publicly documented in Exploit-DB #47577 and the VulnCheck Advisory on Acer.

Detection Methods for CVE-2019-25302

Indicators of Compromise

Presence of unexpected executables such as C:\Program.exe, C:\Program Files.exe, or C:\Program Files (x86)\Launch.exe
New service binaries or DLLs created under C:\Program Files (x86)\Launch Manager\ outside vendor update windows
Process tree anomalies showing services.exe spawning unsigned executables from non-standard paths
Event ID 7045 (service installation) or 7036 (service state change) referencing DsiWMIService with altered binary paths

Detection Strategies

Enumerate service configurations with wmic service get name,pathname,startmode | findstr /i /v "\"" to flag unquoted paths containing spaces
Monitor file creation events in root directories such as C:\ and C:\Program Files (x86)\ for executables created by non-administrative users
Audit child processes of services.exe and alert on binaries lacking valid Authenticode signatures from Acer

Monitoring Recommendations

Enable Windows Security and System event log forwarding to a centralized SIEM for service-related events
Track integrity of the DsiWMIService registry key at HKLM\SYSTEM\CurrentControlSet\Services\DsiWMIService for changes to ImagePath
Alert on Sysmon Event ID 1 (process creation) where the parent is services.exe and the image path resolves outside C:\Program Files (x86)\Launch Manager\

How to Mitigate CVE-2019-25302

Immediate Actions Required

Inventory all endpoints for the presence of Acer Launch Manager 6.1.7600.16385 and the DsiWMIService service
Manually quote the service ImagePath value by setting it to "C:\Program Files (x86)\Launch Manager\dsiwmis.exe"
Restrict write permissions on C:\ and C:\Program Files (x86)\ so that standard users cannot create files in these directories
Disable or uninstall Acer Launch Manager on systems where the functionality is not required

Patch Information

No official vendor patch is referenced in the available advisory data. Refer to the Acer Official Website for product support and updated Launch Manager releases. Administrators should also consult the VulnCheck Advisory on Acer for the latest remediation guidance.

Workarounds

Modify the registry value at HKLM\SYSTEM\CurrentControlSet\Services\DsiWMIService\ImagePath to include surrounding quotes around the full executable path
Set the DsiWMIService startup type to Disabled if the Launch Manager functionality is not required
Apply NTFS access control lists that deny write and execute permissions to standard users on parent directories along the service path

bash

# Configuration example: correct the unquoted service path
sc config DsiWMIService binPath= "\"C:\Program Files (x86)\Launch Manager\dsiwmis.exe\""
sc qc DsiWMIService