Executive Summary

CVE-2025-14305 is a Local Privilege Escalation vulnerability in Acer's ListCheck.exe (version 4.0.0.1 and earlier). An authenticated local attacker can replace the legitimate ListCheck.exe executable with a malicious one of the same name. When the system runs this replaced executable, the attacker gains elevated privileges, allowing them to perform actions with higher system rights than originally permitted. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated local attacker to escalate their privileges on the affected system. By replacing ListCheck.exe with a malicious executable, the attacker can execute code with elevated privileges, potentially compromising system confidentiality, integrity, and availability. This could lead to unauthorized access, modification, or disruption of system resources. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if the vulnerable ListCheck.exe version 4.0.0.1 or earlier is present on your system. Additionally, verify if the executable has been replaced or modified by comparing its hash with a known good version or checking its file properties and timestamps. Commands such as 'dir' or 'ls' to locate ListCheck.exe, and 'certutil -hashfile ListCheck.exe SHA256' on Windows can help verify the file integrity. Monitoring for unexpected execution of ListCheck.exe or unusual privilege escalations may also indicate exploitation attempts. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to delete the vulnerable ListCheck.exe executable entirely, as it is no longer maintained and poses a high risk of local privilege escalation. [1, 2]

Useful 0 Not Useful 0