Acer Backup Manager Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

Acer Backup Manager version 3.0.0.99 has an unquoted service path vulnerability in the NTI IScheduleSvc service. This flaw allows local users to execute arbitrary code by exploiting the unquoted path in the program files directory. Malicious executables can be injected and executed with elevated LocalSystem privileges.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution with elevated privileges.

Reproduction

The vulnerability can be reproduced by injecting a malicious executable into the unquoted service path of 'IScheduleSvc.exe' located in 'C:\Program Files (x86)\NTI\Acer Backup Manager\'. The injected executable will run with LocalSystem privileges, allowing for elevated access on the system.