Medium severity · published Sep 23, 2026
CVE-2026-50227
MQTT WebSocket Command Execution Vulnerability in NitroSense
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NV
NitroSense V5 · Acer
through 5.2.62 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-50227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-50227
community.acer.com
https://community.acer.com/en/kb/articles/20052
More from NitroSense V5
6.1
CVE-2026-50228
Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense