CVE-2026-50227 — MQTT WebSocket Command Execution Vulnerability in NitroSense
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This al…
Published: 2026-09-23 · CVSS: 6.1 · CVSS 4.0
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7