CVE-2026-50227

26th percentile - higher than 26% of all known CVEs

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.

A local attacker can execute arbitrary commands in the application context, potentially leading to system compromise or privilege escalation. However, this requires prior access to the machine.

Update Acer NitroSense to a version later than 5.2.62 that removes the vulnerability. Restrict local access to the MQTT WebSocket endpoint and consider blocking it with a firewall.