Acer Nitrosense V5 vulnerabilities

2 vulnerabilities

Known vulnerabilities in Acer Nitrosense V5, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2026-50227acernitrosense v5
EPSS score
0.35%
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.6.1CVE-2026-50228acernitrosense v5
EPSS score
0.13%
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.