MQTT WebSocket Command Execution Vulnerability in NitroSense
Summary
| CVE | CVE-2026-50227 |
|---|---|
| State | PUBLISHED |
| Assigner | Acer |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-23 08:17:09 UTC |
| Updated | 2026-09-23 15:17:14 UTC |
| Description | An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context. |
Risk And Classification
Primary CVSS: v4.0 6.1 MEDIUM from 8fc372e3-d9c5-46e4-9410-38469745c639
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002630000 probability, percentile 0.184290000 (date 2026-09-23)
Problem Types: CWE-78 | CWE-306 | CWE-306 CWE-306 Missing Authentication for Critical Function | CWE-78 CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 8fc372e3-d9c5-46e4-9410-38469745c639 | Secondary | 6.1 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/C... |
| 4.0 | CNA | CVSS | 6.1 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
CVSS v4.0 Breakdown
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Acer | NitroSense V5 | affected * 5.2.62 custom | Windows |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| community.acer.com/en/kb/articles/20052 | 8fc372e3-d9c5-46e4-9410-38469745c639 | community.acer.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Ayush Choudhary (en)
Additional Advisory Data
Solutions
CNA: Update NitroSense to version 5.2.84 or later to fix.