Vulnerability · Published Sep 23, 2026 · Assigned by Acer

CVE-2026-50227MQTT WebSocket Command Execution Vulnerability in NitroSense

Medium 6.1

In plain English

A medium-severity missing authentication in NitroSense V5 from Acer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)6.1Medium

Exploit odds (30 days)0.3%top 81.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.

Affected products (as reported)

Vendor	Product	Versions
Acer	NitroSense V5	* – through 5.2.62

Weakness: CWE-306, CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

https://community.acer.com/en/kb/articles/20052