The Acer Agent Service component in NitroSense and PredatorSense suffers from a missing authentication check during its socket handshake process. This vulnerability (CWE-306) allows an attacker to potentially establish an unauthorized connection to the service, gaining access to critical functions that should be protected. The CVSS 4.0 base score is 4.9 (medium severity), reflecting local attack vector, low attack complexity, no privileges or user interaction required, but with limited confidentiality and high integrity and availability impacts. Affected versions are those up to and including 1.2.110.2. No vendor advisory or patch information is provided.

An attacker with local access could exploit this vulnerability to connect to the Acer Agent Service without authentication, potentially accessing or manipulating critical service functions. This could compromise the integrity and availability of the service. Confidentiality impact is limited. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the affected service and monitor for unauthorized connections. Avoid exposing the service to untrusted users or networks.