High severity7.8NVD Advisory· Published Dec 17, 2019· Updated Jun 17, 2026
CVE-2019-18670
CVE-2019-18670
Description
In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an arbitrary unsigned DLL into the signed service's process, which is running as NT AUTHORITY\SYSTEM. This is a DLL Hijacking vulnerability (including search order hijacking, which searches for the missing DLL in the PATH environment variable), which is caused by an uncontrolled search path element for nvapi.dll, atiadlxx.dll, or atiadlxy.dll.
Affected products
3cpe:2.3:a:acer:quick_access:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:acer:quick_access:*:*:*:*:*:*:*:*range: >=2.01.3000,<=2.01.3027
- (no CPE)range: 2.01.3000 - 2.01.3027, 3.00.3000 - 3.00.3008
- Acer/Quick Accessdescription
Patches
Vulnerability mechanics
References
2- us.answers.acer.com/app/answers/detail/a_id/64586nvdPatchVendor Advisory
- drive.google.com/opennvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.