This vulnerability in Acer NitroSense V3 (prior to version 3.01.3052) involves the PSAdminAgent service creating a Named Pipe with insufficient access controls. This weakness permits any authenticated local user to connect to the pipe and issue commands without proper privilege checks. Specifically, the service fails to verify the caller's privileges before executing file deletion commands, enabling a local attacker with limited rights to delete arbitrary files with system privileges. The vulnerability is classified under CWE-22 (Path Traversal), CWE-269 (Improper Privilege Management), CWE-284 (Improper Access Control), and CWE-732 (Incorrect Permission Assignment). The CVSS 4.0 base score is 8.5, indicating high severity. No patch or official remediation level has been published yet.

An authenticated local attacker with low privileges can exploit this vulnerability to delete arbitrary files on the system with system-level authority. This can lead to denial of service or potentially facilitate further privilege escalation or system compromise depending on which files are deleted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user access to trusted individuals only and monitor for suspicious local activity related to the PSAdminAgent service. Avoid running NitroSense with elevated privileges where possible.