CVE-2019-18670 - CVE House
Back to Database
Status published High CVE-2019-18670

In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access...

Vulnerability Description

In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an arbitrary unsigned DLL into the signed service's process, which is running as NT AUTHORITY\SYSTEM. This is a DLL Hijacking vulnerability (including search order hijacking, which searches for the missing DLL in the PATH environment variable), which is caused by an uncontrolled search path element for nvapi.dll, atiadlxx.dll, or atiadlxy.dll.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-18670

Credits & Attribution

No credits recorded in the NVD database.

References

More from acer

View All →
CVE-2022-41415
Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a...
Unknown 0
CVE-2022-40080
Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in...
Unknown 0
CVE-2022-30426
There is a stack buffer overflow vulnerability, which could lead...
Unknown 0
CVE-2022-24286
Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains...
High 7.8
CVE-2022-24285
Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege...
High 7.8

Affected Vendor

Affected Software

quick access
Vulnerable Versions:
2.01.3000, 3.00.3000

Timeline

Official Publish: December 17th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.