CVE-2026-50227

UNKNOWN

Description

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.

Timeline

Published:September 23rd, 2026 8:17 AM

Last modified:September 23rd, 2026 3:17 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-78 CWE-306

References & Reports

Advisories, patches, and third-party reports

https://community.acer.com/en/kb/articles/20052

Source: NIST NVD · Data may lag official sources by up to one minute