Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-50227

MQTT WebSocket Command Execution Vulnerability in NitroSense

CVSS 4.0 6.1 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-50227

Published

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-50227

Published

NitroSense V5

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Acer",
                    "product": "NitroSense V5",
                    "platforms": [
                        "Windows"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "*",
                            "lessThanOrEqual": "5.2.62",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON