Executive brief
NitroSense and PredatorSense are Acer system management utilities that include an Agent Service component. A hardcoded AES encryption key embedded in the software allows local attackers to decrypt protected data and potentially execute unauthorized actions on affected systems.
Technical details
The vulnerability is a hardcoded cryptographic key issue in the Acer Agent Service component used by NitroSense and PredatorSense. The AES encryption key is embedded directly in the software, allowing any local user with access to the executable or configuration files to recover it and decrypt protected information. The attack requires local access to the affected system; no network exploitation is possible. An attacker can decrypt sensitive data stored by these applications and potentially escalate privileges or perform other unauthorized actions depending on what information is protected by the key.
Affected products
- Acer NitroSense <UNKNOWN>
- Acer PredatorSense <UNKNOWN>
Timeline
- 2026-09-17: disclosed