CVE-2025-5491: Acer ControlCenter RCE Vulnerability

CVE-2025-5491 Overview

CVE-2025-5491 is a remote code execution vulnerability in Acer ControlCenter. The affected component, accsvc.exe, exposes a Windows Named Pipe that implements a custom protocol for invoking internal functions. The pipe is misconfigured with overly permissive access controls, allowing low-privileged remote users to connect and interact with its features. One exposed function permits execution of arbitrary programs under the NT AUTHORITY/SYSTEM account. An authenticated attacker on the network can chain this misconfiguration to run code with full SYSTEM privileges on the target host. The flaw maps to [CWE-269: Improper Privilege Management].

Critical Impact

Authenticated remote attackers can execute arbitrary commands as NT AUTHORITY/SYSTEM, achieving full compromise of any Windows host running a vulnerable Acer ControlCenter installation.

Affected Products

• Acer ControlCenter (Windows desktop management utility)
• accsvc.exe service component exposing the named pipe
• Acer consumer and commercial systems shipping ControlCenter by default

Discovery Timeline

• 2025-06-13 - CVE-2025-5491 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-5491

Vulnerability Analysis

The accsvc.exe service in Acer ControlCenter creates a Windows Named Pipe to receive control messages from privileged components. Named Pipes inherit a security descriptor that defines which security principals can open, read, and write to the endpoint. In this case, the descriptor grants access to broad groups such as authenticated users rather than restricting access to the local SYSTEM context or specific service accounts.

Clients communicate with accsvc.exe using a custom binary protocol that dispatches to internal handler routines. One handler accepts a program path and command-line arguments, then launches the requested executable in the service's own SYSTEM token. Combining a permissive ACL with a process-creation handler converts a benign IPC channel into a privilege escalation primitive available to any logged-on or remotely authenticated user.

Root Cause

The root cause is improper privilege management on the named pipe object. The service assigns a security descriptor that does not enforce least privilege, exposing SYSTEM-level functionality to low-privileged callers without any authentication or integrity check inside the custom protocol itself.

Attack Vector

Exploitation requires network reachability to the host and low-privileged credentials. An attacker authenticates to the target, opens a handle to the Acer-defined named pipe over SMB or locally, frames a protocol message invoking the process-creation handler, and supplies an attacker-controlled executable path. The service launches the payload as SYSTEM. No user interaction is required.

No public proof-of-concept code has been verified for this CVE. Refer to the Acer Security Advisory and the TW-CERT Vulnerability Report for vendor-provided technical detail.

Detection Methods for CVE-2025-5491

Indicators of Compromise

• Unexpected child processes spawned by accsvc.exe running under the NT AUTHORITY\SYSTEM account.
• Remote SMB connections to the host followed by named pipe access targeting Acer-defined pipe names.
• Creation or execution of unsigned binaries from world-writable directories shortly after accsvc.exe activity.
• New scheduled tasks, services, or persistence mechanisms introduced by processes parented to accsvc.exe.

Detection Strategies

• Hunt for process-creation events where the parent image is accsvc.exe and the child is cmd.exe, powershell.exe, rundll32.exe, or any binary outside Acer's signed install path.
• Monitor Windows Event ID 5145 for remote access to named pipes associated with Acer ControlCenter from non-administrative principals.
• Correlate authentication events from low-privileged accounts with subsequent SYSTEM-level process executions on the same host.

Monitoring Recommendations

• Enable detailed process-creation auditing (Event ID 4688) and Sysmon Event ID 1 with command-line logging across endpoints running Acer software.
• Ingest endpoint telemetry into a centralized data lake such as Singularity Data Lake to enable cross-host correlation of accsvc.exe child-process anomalies.
• Use Singularity Endpoint behavioral AI to flag privilege-escalation patterns where a service-account process launches user-supplied executables.

How to Mitigate CVE-2025-5491

Immediate Actions Required

• Inventory all Windows hosts running Acer ControlCenter and prioritize patching for systems exposing SMB to untrusted networks.
• Apply the security update published in the Acer Security Advisory on all affected endpoints.
• Restrict inbound SMB (TCP/445) at the network perimeter and between user VLANs to limit remote named pipe access.
• Audit local user and service accounts to ensure low-privileged credentials cannot reach managed endpoints over the network.

Patch Information

Acer has published a fixed version of ControlCenter through its support portal. Administrators should review the Acer Security Advisory and the TW-CERT Security Notification for the exact build numbers and deployment guidance, then push the update through standard software-management tooling.

Workarounds

• If patching is not immediately possible, stop and disable the accsvc.exe service to remove the vulnerable named pipe entirely.
• Uninstall Acer ControlCenter on hosts that do not require its functionality, particularly servers and shared workstations.
• Block remote named pipe access by disabling SMB null sessions and tightening firewall rules so only management systems can reach TCP/445.

# Disable the Acer ControlCenter service as a temporary workaround
sc.exe stop "accsvc"
sc.exe config "accsvc" start= disabled

# Verify the service is no longer listening on its named pipe
Get-Service -Name accsvc