CVE-2026-50227CWE-306CWE-78command-injection

CVE-2026-50227

published September 23, 2026

CVSS
6.1
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.

The record
Technical detail
CVSS
6.1 · NONE
CVSS v4.0
6.1 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00348 · 27.2th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-23T12:17Z
References (1)
https://community.acer.com/en/kb/articles/20052 · 8fc372e3-d9c5-46e4-9410-38469745c639
EPSS history
Timeline
  • 24 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 23 SEP 07:15Z
    MQTT WebSocket Command Execution Vulnerability in NitroSense
    cvelistv5