CVE-2025-14305
Local Privilege Escalation in Acer ListCheck.exe via Executable Replacement
Publication date: 2025-12-17
Last updated on: 2025-12-17
Assigner: TWCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| acer | listcheck | 4.0.0.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-14305 is a Local Privilege Escalation vulnerability in Acer's ListCheck.exe (version 4.0.0.1 and earlier). An authenticated local attacker can replace the legitimate ListCheck.exe executable with a malicious one of the same name. When the system runs this replaced executable, the attacker gains elevated privileges, allowing them to perform actions with higher system rights than originally permitted. [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated local attacker to escalate their privileges on the affected system. By replacing ListCheck.exe with a malicious executable, the attacker can execute code with elevated privileges, potentially compromising system confidentiality, integrity, and availability. This could lead to unauthorized access, modification, or disruption of system resources. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the vulnerable ListCheck.exe version 4.0.0.1 or earlier is present on your system. Additionally, verify if the executable has been replaced or modified by comparing its hash with a known good version or checking its file properties and timestamps. Commands such as 'dir' or 'ls' to locate ListCheck.exe, and 'certutil -hashfile ListCheck.exe SHA256' on Windows can help verify the file integrity. Monitoring for unexpected execution of ListCheck.exe or unusual privilege escalations may also indicate exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to delete the vulnerable ListCheck.exe executable entirely, as it is no longer maintained and poses a high risk of local privilege escalation. [1, 2]