CVEvulnerability

CVE-2026-50227

6.1 MEDIUM Published 2026-09-23 Modified 2026-09-25 Official page ↗
Status
Deferred
Published
2026-09-23
Last modified
2026-09-25
Assigner
8fc372e3-d9c5-46e4-9410-38469745c639
CVSS 4.0 (8fc372e3-d9c5-46e4-9410-38469745c639)
6.1 MEDIUM — CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-306, CWE-78

Description

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.

Related

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References