Acer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path | Advisories

Advisories

Acer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path

severity: high
date: January 16, 2026
Affecting: Acer Backup Manager Module 3.0.0.99
CVE: CVE-2021-47826
CWE: CWE-428 Unquoted Search Path or Element
CVSS: 8.5
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-49889
Acer Official Homepage
Credit: Emmanuel Lujan
Description: Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\NTI\Acer Backup Manager\ to inject malicious executables that would run with elevated LocalSystem privileges.