This vulnerability arises from the use of a hardcoded AES-128-ECB encryption key within the Acer Agent Service component bundled with NitroSense and PredatorSense software. The presence of a fixed cryptographic key weakens the encryption's confidentiality guarantees, potentially enabling a local attacker to decrypt sensitive data or manipulate protected operations. The affected versions are those up to and including 1.2.110.2. The CVSS 4.0 base score is 4.9, reflecting a medium severity with local attack vector and low complexity.

An attacker with local access could exploit the hardcoded AES key to decrypt or manipulate data protected by the encryption, potentially leading to unauthorized information disclosure or actions within the affected software environment. The vulnerability does not require user interaction or privileges but is limited to local attackers. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit local access to trusted users only and monitor for updates from Acer regarding patches or mitigations.